Wireshark-bugs: [Wireshark-bugs] [Bug 10744] New: Buildbot crash output: fuzz-2014-11-28-11873.p

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sat, 29 Nov 2014 21:30:02 +0000
Bug ID 10744
Summary Buildbot crash output: fuzz-2014-11-28-11873.pcap
Product Wireshark
Version unspecified
Hardware x86-64
URL https://www.wireshark.org/download/automated/captures/fuzz-2014-11-28-11873.pcap
OS Ubuntu
Status CONFIRMED
Severity Major
Priority High
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected] 

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2014-11-28-11873.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/cmp-trace.pcap.gz

Build host information:
Linux wsbb04 3.13.0-39-generic #66-Ubuntu SMP Tue Oct 28 13:30:27 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://[email protected]:29418/wireshark
BUILDBOT_BUILDNUMBER=3075
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=cc893abb25cc568d17ae1afcb4822f521d1f9e30

Return value:  0

Dissector bug:  0

Valgrind error count:  94



Git commit
commit cc893abb25cc568d17ae1afcb4822f521d1f9e30
Author: Pascal Quantin <[email protected]>
Date:   Wed Nov 26 23:01:48 2014 +0100

    XML: pass XML structure to caller through p_(add|get)_proto_data functions

    Since ge3a04bb data parameter is used for the media-type string

    Bug: 10729
    Change-Id: I3df640079a8bf57f4bd86a1baa08cbf9a3a7e1b3
    Reviewed-on: https://code.wireshark.org/review/5511
    Reviewed-by: Pascal Quantin <[email protected]>
    Reviewed-by: Michael Mann <[email protected]>


Command and args: ./tools/valgrind-wireshark.sh 

==9073== Memcheck, a memory error detector
==9073== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==9073== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==9073== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2014-11-28-11873.pcap
==9073== 
==9073== Invalid read of size 1
==9073==    at 0x9AE9FE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x9AE9568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x67A6970: call_ber_oid_callback (packet-ber.c:550)
==9073==    by 0x6FD551C: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6FD535F: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==9073==    by 0x67A9346: dissect_ber_sq_of (packet-ber.c:3502)
==9073==    by 0x67A9AFD: dissect_ber_sequence_of (packet-ber.c:3533)
==9073==    by 0x6FD5B2F: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6F0153F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==  Address 0x12c3be00 is 0 bytes inside a block of size 46 free'd
==9073==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9073==    by 0x669CC14: emem_free_all (emem.c:1187)
==9073==    by 0x669DD80: epan_dissect_run_with_taps (epan.c:350)
==9073==    by 0x413693: process_packet (tshark.c:3529)
==9073==    by 0x40C7F7: main (tshark.c:3317)
==9073== 
==9073== Invalid read of size 1
==9073==    at 0x9AE9FFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x9AE9568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x67A6970: call_ber_oid_callback (packet-ber.c:550)
==9073==    by 0x6FD551C: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6FD535F: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==9073==    by 0x67A9346: dissect_ber_sq_of (packet-ber.c:3502)
==9073==    by 0x67A9AFD: dissect_ber_sequence_of (packet-ber.c:3533)
==9073==    by 0x6FD5B2F: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6F0153F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==  Address 0x12c3be01 is 1 bytes inside a block of size 46 free'd
==9073==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9073==    by 0x669CC14: emem_free_all (emem.c:1187)
==9073==    by 0x669DD80: epan_dissect_run_with_taps (epan.c:350)
==9073==    by 0x413693: process_packet (tshark.c:3529)
==9073==    by 0x40C7F7: main (tshark.c:3317)
==9073== 
==9073== Invalid read of size 1
==9073==    at 0x9AE9FE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x9AE9568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x66A91FF: dissector_try_string (packet.c:1394)
==9073==    by 0x67A69D8: call_ber_oid_callback (packet-ber.c:1116)
==9073==    by 0x6FD551C: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6FD535F: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==9073==    by 0x67A9346: dissect_ber_sq_of (packet-ber.c:3502)
==9073==    by 0x67A9AFD: dissect_ber_sequence_of (packet-ber.c:3533)
==9073==    by 0x6FD5B2F: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6F0153F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==9073==  Address 0x12c3be00 is 0 bytes inside a block of size 46 free'd
==9073==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9073==    by 0x669CC14: emem_free_all (emem.c:1187)
==9073==    by 0x669DD80: epan_dissect_run_with_taps (epan.c:350)
==9073==    by 0x413693: process_packet (tshark.c:3529)
==9073==    by 0x40C7F7: main (tshark.c:3317)
==9073== 
==9073== Invalid read of size 1
==9073==    at 0x9AE9FFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x9AE9568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==9073==    by 0x66A91FF: dissector_try_string (packet.c:1394)
==9073==    by 0x67A69D8: call_ber_oid_callback (packet-ber.c:1116)
==9073==    by 0x6FD551C: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6FD535F: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==9073==    by 0x67A9346: dissect_ber_sq_of (packet-ber.c:3502)
==9073==    by 0x67A9AFD: dissect_ber_sequence_of (packet-ber.c:3533)
==9073==    by 0x6FD5B2F: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==9073==    by 0x67A75BC: dissect_ber_sequence (packet-ber.c:2403)
==9073==    by 0x6F0153F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==9073==  Address 0x12c3be01 is 1 bytes inside a block of size 46 free'd
==9073==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==9073==    by 0x669CC14: emem_free_all (emem.c:1187)
==9073==    by 0x669DD80: epan_dissect_run_with_taps (epan.c:350)
==9073==    by 0x413693: process_packet (tshark.c:3529)
==9073==    by 0x40C7F7: main (tshark.c:3317)
==9073== 
==9073== 
==9073== HEAP SUMMARY:
==9073==     in use at exit: 1,216,485 bytes in 29,647 blocks
==9073==   total heap usage: 416,995 allocs, 387,348 frees, 38,892,893 bytes
allocated
==9073== 
==9073== LEAK SUMMARY:
==9073==    definitely lost: 4,008 bytes in 178 blocks
==9073==    indirectly lost: 36,744 bytes in 51 blocks
==9073==      possibly lost: 0 bytes in 0 blocks
==9073==    still reachable: 1,175,733 bytes in 29,418 blocks
==9073==         suppressed: 0 bytes in 0 blocks
==9073== Rerun with --leak-check=full to see details of leaked memory
==9073== 
==9073== For counts of detected and suppressed errors, rerun with: -v
==9073== ERROR SUMMARY: 94 errors from 4 contexts (suppressed: 0 from 0)

[ no debug trace ]

You are receiving this mail because:
  • You are watching all bug changes.