Wireshark-bugs: [Wireshark-bugs] [Bug 10609] New: Buildbot crash output: fuzz-2014-10-21-31844.p

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 23 Oct 2014 00:20:02 +0000
Bug ID 10609
Summary Buildbot crash output: fuzz-2014-10-21-31844.pcap
Product Wireshark
Version unspecified
Hardware x86-64
URL https://www.wireshark.org/download/automated/captures/fuzz-2014-10-21-31844.pcap
OS Ubuntu
Status CONFIRMED
Severity Major
Priority High
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected] 

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2014-10-21-31844.pcap

stderr:
Input file:
/home/wireshark/menagerie/menagerie/9630-ATLAS_FTAM_TCP_TRACE_2012110713400115.pcap

Build host information:
Linux wsbb04 3.13.0-37-generic #64-Ubuntu SMP Mon Sep 22 21:28:38 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://[email protected]:29418/wireshark
BUILDBOT_BUILDNUMBER=3010
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=80e6f6251e96dd7b8a9ab0fdbf63b03a73ef6692

Return value:  0

Dissector bug:  0

Valgrind error count:  39



Git commit
commit 80e6f6251e96dd7b8a9ab0fdbf63b03a73ef6692
Author: Guy Harris <[email protected]>
Date:   Sun Oct 19 23:14:50 2014 -0700

    Get rid of calls to ctype.h functions.

    They don't handle values outside the range -1 to 127, and their behavior
    is locale-dependent.  Use g_ascii_isXXX() and g_ascii_toXXX() instead of
    isXXX() and toXXX().

    If you're checking for printable ASCII, don't use isascii() and don't
    use iscntrl(), use g_ascii_isprint().  If you're checking for graphical
    ASCII, i.e. printable ASCII except for a space, use g_ascii_isgraph().

    Use ws_xton() to convert a hex digit character to the corresponding
    numeric value.

    Change-Id: Id3039bc586fbf66d8736c2df248c790c0d7a2330
    Reviewed-on: https://code.wireshark.org/review/4851
    Reviewed-by: Guy Harris <[email protected]>


Command and args: ./tools/valgrind-wireshark.sh 

==24044== Memcheck, a memory error detector
==24044== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==24044== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==24044== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2014-10-21-31844.pcap
==24044== 
==24044== Invalid read of size 1
==24044==    at 0x9AAEFE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x9AAE568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x678C2A0: call_ber_oid_callback (packet-ber.c:538)
==24044==    by 0x678B306: dissect_ber_choice (packet-ber.c:2903)
==24044==    by 0x6EC32BF: dissect_acse_T_encoding (acse.cnf:129)
==24044==    by 0x678CF4C: dissect_ber_sequence (packet-ber.c:2403)
==24044==    by 0x6EC2EFF: dissect_acse_EXTERNALt_U (acse.cnf:147)
==24044==    by 0x678A51A: dissect_ber_tagged_type (packet-ber.c:704)
==24044==    by 0x6EC2DCD: dissect_acse_EXTERNALt (acse.cnf:157)
==24044==    by 0x678EB8F: dissect_ber_sq_of (packet-ber.c:3486)
==24044==    by 0x678F37D: dissect_ber_sequence_of (packet-ber.c:3517)
==24044==    by 0x6EC3F6F: dissect_acse_Association_data (acse.cnf:287)
==24044==  Address 0x12006f20 is 0 bytes inside a block of size 13 free'd
==24044==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x71B33CC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==24044==    by 0x71B404B: wmem_leave_packet_scope (wmem_scopes.c:81)
==24044==    by 0x4135C3: process_packet (tshark.c:3524)
==24044==    by 0x40C3E3: main (tshark.c:3312)
==24044== 
==24044== Invalid read of size 1
==24044==    at 0x9AAEFFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x9AAE568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x678C2A0: call_ber_oid_callback (packet-ber.c:538)
==24044==    by 0x678B306: dissect_ber_choice (packet-ber.c:2903)
==24044==    by 0x6EC32BF: dissect_acse_T_encoding (acse.cnf:129)
==24044==    by 0x678CF4C: dissect_ber_sequence (packet-ber.c:2403)
==24044==    by 0x6EC2EFF: dissect_acse_EXTERNALt_U (acse.cnf:147)
==24044==    by 0x678A51A: dissect_ber_tagged_type (packet-ber.c:704)
==24044==    by 0x6EC2DCD: dissect_acse_EXTERNALt (acse.cnf:157)
==24044==    by 0x678EB8F: dissect_ber_sq_of (packet-ber.c:3486)
==24044==    by 0x678F37D: dissect_ber_sequence_of (packet-ber.c:3517)
==24044==    by 0x6EC3F6F: dissect_acse_Association_data (acse.cnf:287)
==24044==  Address 0x12006f21 is 1 bytes inside a block of size 13 free'd
==24044==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x71B33CC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==24044==    by 0x71B404B: wmem_leave_packet_scope (wmem_scopes.c:81)
==24044==    by 0x4135C3: process_packet (tshark.c:3524)
==24044==    by 0x40C3E3: main (tshark.c:3312)
==24044== 
==24044== Invalid read of size 1
==24044==    at 0x9AAEFE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x9AAE568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x6692EEF: dissector_try_string (packet.c:1397)
==24044==    by 0x678C308: call_ber_oid_callback (packet-ber.c:1104)
==24044==    by 0x678B306: dissect_ber_choice (packet-ber.c:2903)
==24044==    by 0x6EC32BF: dissect_acse_T_encoding (acse.cnf:129)
==24044==    by 0x678CF4C: dissect_ber_sequence (packet-ber.c:2403)
==24044==    by 0x6EC2EFF: dissect_acse_EXTERNALt_U (acse.cnf:147)
==24044==    by 0x678A51A: dissect_ber_tagged_type (packet-ber.c:704)
==24044==    by 0x6EC2DCD: dissect_acse_EXTERNALt (acse.cnf:157)
==24044==    by 0x678EB8F: dissect_ber_sq_of (packet-ber.c:3486)
==24044==    by 0x678F37D: dissect_ber_sequence_of (packet-ber.c:3517)
==24044==  Address 0x12006f20 is 0 bytes inside a block of size 13 free'd
==24044==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x71B33CC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==24044==    by 0x71B404B: wmem_leave_packet_scope (wmem_scopes.c:81)
==24044==    by 0x4135C3: process_packet (tshark.c:3524)
==24044==    by 0x40C3E3: main (tshark.c:3312)
==24044== 
==24044== Invalid read of size 1
==24044==    at 0x9AAEFFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x9AAE568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x6692EEF: dissector_try_string (packet.c:1397)
==24044==    by 0x678C308: call_ber_oid_callback (packet-ber.c:1104)
==24044==    by 0x678B306: dissect_ber_choice (packet-ber.c:2903)
==24044==    by 0x6EC32BF: dissect_acse_T_encoding (acse.cnf:129)
==24044==    by 0x678CF4C: dissect_ber_sequence (packet-ber.c:2403)
==24044==    by 0x6EC2EFF: dissect_acse_EXTERNALt_U (acse.cnf:147)
==24044==    by 0x678A51A: dissect_ber_tagged_type (packet-ber.c:704)
==24044==    by 0x6EC2DCD: dissect_acse_EXTERNALt (acse.cnf:157)
==24044==    by 0x678EB8F: dissect_ber_sq_of (packet-ber.c:3486)
==24044==    by 0x678F37D: dissect_ber_sequence_of (packet-ber.c:3517)
==24044==  Address 0x12006f21 is 1 bytes inside a block of size 13 free'd
==24044==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x71B33CC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==24044==    by 0x71B404B: wmem_leave_packet_scope (wmem_scopes.c:81)
==24044==    by 0x4135C3: process_packet (tshark.c:3524)
==24044==    by 0x40C3E3: main (tshark.c:3312)
==24044== 
==24044== Invalid read of size 1
==24044==    at 0x4C2F1B4: strcmp (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x9AAEFC8: g_str_equal (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x9AAE5EF: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x6692EEF: dissector_try_string (packet.c:1397)
==24044==    by 0x678C308: call_ber_oid_callback (packet-ber.c:1104)
==24044==    by 0x678B306: dissect_ber_choice (packet-ber.c:2903)
==24044==    by 0x6EC32BF: dissect_acse_T_encoding (acse.cnf:129)
==24044==    by 0x678CF4C: dissect_ber_sequence (packet-ber.c:2403)
==24044==    by 0x6EC2EFF: dissect_acse_EXTERNALt_U (acse.cnf:147)
==24044==    by 0x678A51A: dissect_ber_tagged_type (packet-ber.c:704)
==24044==    by 0x6EC2DCD: dissect_acse_EXTERNALt (acse.cnf:157)
==24044==    by 0x678EB8F: dissect_ber_sq_of (packet-ber.c:3486)
==24044==  Address 0x12006f20 is 0 bytes inside a block of size 13 free'd
==24044==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x71B33CC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==24044==    by 0x71B404B: wmem_leave_packet_scope (wmem_scopes.c:81)
==24044==    by 0x4135C3: process_packet (tshark.c:3524)
==24044==    by 0x40C3E3: main (tshark.c:3312)
==24044== 
==24044== Invalid read of size 1
==24044==    at 0x4C2F1CB: strcmp (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x9AAEFC8: g_str_equal (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x9AAE5EF: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4000.0)
==24044==    by 0x6692EEF: dissector_try_string (packet.c:1397)
==24044==    by 0x678C308: call_ber_oid_callback (packet-ber.c:1104)
==24044==    by 0x678B306: dissect_ber_choice (packet-ber.c:2903)
==24044==    by 0x6EC32BF: dissect_acse_T_encoding (acse.cnf:129)
==24044==    by 0x678CF4C: dissect_ber_sequence (packet-ber.c:2403)
==24044==    by 0x6EC2EFF: dissect_acse_EXTERNALt_U (acse.cnf:147)
==24044==    by 0x678A51A: dissect_ber_tagged_type (packet-ber.c:704)
==24044==    by 0x6EC2DCD: dissect_acse_EXTERNALt (acse.cnf:157)
==24044==    by 0x678EB8F: dissect_ber_sq_of (packet-ber.c:3486)
==24044==  Address 0x12006f21 is 1 bytes inside a block of size 13 free'd
==24044==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==24044==    by 0x71B33CC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==24044==    by 0x71B404B: wmem_leave_packet_scope (wmem_scopes.c:81)
==24044==    by 0x4135C3: process_packet (tshark.c:3524)
==24044==    by 0x40C3E3: main (tshark.c:3312)
==24044== 
==24044== 
==24044== HEAP SUMMARY:
==24044==     in use at exit: 1,252,017 bytes in 30,794 blocks
==24044==   total heap usage: 952,774 allocs, 921,980 frees, 63,571,464 bytes
allocated
==24044== 
==24044== LEAK SUMMARY:
==24044==    definitely lost: 15,657 bytes in 1,324 blocks
==24044==    indirectly lost: 36,648 bytes in 49 blocks
==24044==      possibly lost: 0 bytes in 0 blocks
==24044==    still reachable: 1,199,712 bytes in 29,421 blocks
==24044==         suppressed: 0 bytes in 0 blocks
==24044== Rerun with --leak-check=full to see details of leaked memory
==24044== 
==24044== For counts of detected and suppressed errors, rerun with: -v
==24044== ERROR SUMMARY: 39 errors from 6 contexts (suppressed: 0 from 0)

[ no debug trace ]

You are receiving this mail because:
  • You are watching all bug changes.