Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10787] New: Buildbot crash output: fuzz-2014-12-16-12596.pcap

Wireshark-bugs: [Wireshark-bugs] [Bug 10787] New: Buildbot crash output: fuzz-2014-12-16-12596.p

Date: Thu, 18 Dec 2014 02:20:04 +0000

Bug ID	10787
Summary	Buildbot crash output: fuzz-2014-12-16-12596.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2014-12-16-12596.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	[email protected]
Reporter	[email protected]

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2014-12-16-12596.pcap

stderr:
Input file:
/home/wireshark/menagerie/menagerie/9630-ATLAS_FTAM_TCP_TRACE_2012110713400115.pcap

Build host information:
Linux wsbb04 3.13.0-39-generic #66-Ubuntu SMP Tue Oct 28 13:30:27 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://[email protected]:29418/wireshark
BUILDBOT_BUILDNUMBER=3083
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=9815dc19fb1cadc506e3da963ff7291bf2538a64

Return value:  0

Dissector bug:  0

Valgrind error count:  39



Git commit
commit 9815dc19fb1cadc506e3da963ff7291bf2538a64
Author: maisheri <[email protected]>
Date:   Sun Dec 14 01:44:20 2014 +0530

    Add support for EAPOL-MKA (802.1x-2010)

    Use by MACSec

    Change-Id: I27eee40ddc476435aecd57711c1b3597c2049901
    Reviewed-on: https://code.wireshark.org/review/5751
    Reviewed-by: Alexis La Goutte <[email protected]>


Command and args: ./tools/valgrind-wireshark.sh 

==10747== Memcheck, a memory error detector
==10747== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==10747== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==10747== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2014-12-16-12596.pcap
==10747== 
==10747== Invalid read of size 1
==10747==    at 0x9B26FE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x9B26568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x67C07D0: call_ber_oid_callback (packet-ber.c:551)
==10747==    by 0x67BF806: dissect_ber_choice (packet-ber.c:2925)
==10747==    by 0x6F005EF: dissect_acse_T_encoding (acse.cnf:129)
==10747==    by 0x67C141C: dissect_ber_sequence (packet-ber.c:2425)
==10747==    by 0x6F0022F: dissect_acse_EXTERNALt_U (acse.cnf:147)
==10747==    by 0x67BE93A: dissect_ber_tagged_type (packet-ber.c:717)
==10747==    by 0x6F000FD: dissect_acse_EXTERNALt (acse.cnf:157)
==10747==    by 0x67C31A6: dissect_ber_sq_of (packet-ber.c:3524)
==10747==    by 0x67C395D: dissect_ber_sequence_of (packet-ber.c:3555)
==10747==    by 0x6F0129F: dissect_acse_Association_data (acse.cnf:287)
==10747==  Address 0x131bba70 is 0 bytes inside a block of size 13 free'd
==10747==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x71F1BFC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==10747==    by 0x71F287B: wmem_leave_packet_scope (wmem_scopes.c:81)
==10747==    by 0x413713: process_packet (tshark.c:3531)
==10747==    by 0x40C871: main (tshark.c:3317)
==10747== 
==10747== Invalid read of size 1
==10747==    at 0x9B26FFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x9B26568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x67C07D0: call_ber_oid_callback (packet-ber.c:551)
==10747==    by 0x67BF806: dissect_ber_choice (packet-ber.c:2925)
==10747==    by 0x6F005EF: dissect_acse_T_encoding (acse.cnf:129)
==10747==    by 0x67C141C: dissect_ber_sequence (packet-ber.c:2425)
==10747==    by 0x6F0022F: dissect_acse_EXTERNALt_U (acse.cnf:147)
==10747==    by 0x67BE93A: dissect_ber_tagged_type (packet-ber.c:717)
==10747==    by 0x6F000FD: dissect_acse_EXTERNALt (acse.cnf:157)
==10747==    by 0x67C31A6: dissect_ber_sq_of (packet-ber.c:3524)
==10747==    by 0x67C395D: dissect_ber_sequence_of (packet-ber.c:3555)
==10747==    by 0x6F0129F: dissect_acse_Association_data (acse.cnf:287)
==10747==  Address 0x131bba71 is 1 bytes inside a block of size 13 free'd
==10747==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x71F1BFC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==10747==    by 0x71F287B: wmem_leave_packet_scope (wmem_scopes.c:81)
==10747==    by 0x413713: process_packet (tshark.c:3531)
==10747==    by 0x40C871: main (tshark.c:3317)
==10747== 
==10747== Invalid read of size 1
==10747==    at 0x9B26FE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x9B26568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x66C450F: dissector_try_string (packet.c:1392)
==10747==    by 0x67C0838: call_ber_oid_callback (packet-ber.c:1120)
==10747==    by 0x67BF806: dissect_ber_choice (packet-ber.c:2925)
==10747==    by 0x6F005EF: dissect_acse_T_encoding (acse.cnf:129)
==10747==    by 0x67C141C: dissect_ber_sequence (packet-ber.c:2425)
==10747==    by 0x6F0022F: dissect_acse_EXTERNALt_U (acse.cnf:147)
==10747==    by 0x67BE93A: dissect_ber_tagged_type (packet-ber.c:717)
==10747==    by 0x6F000FD: dissect_acse_EXTERNALt (acse.cnf:157)
==10747==    by 0x67C31A6: dissect_ber_sq_of (packet-ber.c:3524)
==10747==    by 0x67C395D: dissect_ber_sequence_of (packet-ber.c:3555)
==10747==  Address 0x131bba70 is 0 bytes inside a block of size 13 free'd
==10747==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x71F1BFC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==10747==    by 0x71F287B: wmem_leave_packet_scope (wmem_scopes.c:81)
==10747==    by 0x413713: process_packet (tshark.c:3531)
==10747==    by 0x40C871: main (tshark.c:3317)
==10747== 
==10747== Invalid read of size 1
==10747==    at 0x9B26FFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x9B26568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x66C450F: dissector_try_string (packet.c:1392)
==10747==    by 0x67C0838: call_ber_oid_callback (packet-ber.c:1120)
==10747==    by 0x67BF806: dissect_ber_choice (packet-ber.c:2925)
==10747==    by 0x6F005EF: dissect_acse_T_encoding (acse.cnf:129)
==10747==    by 0x67C141C: dissect_ber_sequence (packet-ber.c:2425)
==10747==    by 0x6F0022F: dissect_acse_EXTERNALt_U (acse.cnf:147)
==10747==    by 0x67BE93A: dissect_ber_tagged_type (packet-ber.c:717)
==10747==    by 0x6F000FD: dissect_acse_EXTERNALt (acse.cnf:157)
==10747==    by 0x67C31A6: dissect_ber_sq_of (packet-ber.c:3524)
==10747==    by 0x67C395D: dissect_ber_sequence_of (packet-ber.c:3555)
==10747==  Address 0x131bba71 is 1 bytes inside a block of size 13 free'd
==10747==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x71F1BFC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==10747==    by 0x71F287B: wmem_leave_packet_scope (wmem_scopes.c:81)
==10747==    by 0x413713: process_packet (tshark.c:3531)
==10747==    by 0x40C871: main (tshark.c:3317)
==10747== 
==10747== Invalid read of size 1
==10747==    at 0x4C2F1B4: strcmp (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x9B26FC8: g_str_equal (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x9B265EF: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x66C450F: dissector_try_string (packet.c:1392)
==10747==    by 0x67C0838: call_ber_oid_callback (packet-ber.c:1120)
==10747==    by 0x67BF806: dissect_ber_choice (packet-ber.c:2925)
==10747==    by 0x6F005EF: dissect_acse_T_encoding (acse.cnf:129)
==10747==    by 0x67C141C: dissect_ber_sequence (packet-ber.c:2425)
==10747==    by 0x6F0022F: dissect_acse_EXTERNALt_U (acse.cnf:147)
==10747==    by 0x67BE93A: dissect_ber_tagged_type (packet-ber.c:717)
==10747==    by 0x6F000FD: dissect_acse_EXTERNALt (acse.cnf:157)
==10747==    by 0x67C31A6: dissect_ber_sq_of (packet-ber.c:3524)
==10747==  Address 0x131bba70 is 0 bytes inside a block of size 13 free'd
==10747==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x71F1BFC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==10747==    by 0x71F287B: wmem_leave_packet_scope (wmem_scopes.c:81)
==10747==    by 0x413713: process_packet (tshark.c:3531)
==10747==    by 0x40C871: main (tshark.c:3317)
==10747== 
==10747== Invalid read of size 1
==10747==    at 0x4C2F1CB: strcmp (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x9B26FC8: g_str_equal (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x9B265EF: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==10747==    by 0x66C450F: dissector_try_string (packet.c:1392)
==10747==    by 0x67C0838: call_ber_oid_callback (packet-ber.c:1120)
==10747==    by 0x67BF806: dissect_ber_choice (packet-ber.c:2925)
==10747==    by 0x6F005EF: dissect_acse_T_encoding (acse.cnf:129)
==10747==    by 0x67C141C: dissect_ber_sequence (packet-ber.c:2425)
==10747==    by 0x6F0022F: dissect_acse_EXTERNALt_U (acse.cnf:147)
==10747==    by 0x67BE93A: dissect_ber_tagged_type (packet-ber.c:717)
==10747==    by 0x6F000FD: dissect_acse_EXTERNALt (acse.cnf:157)
==10747==    by 0x67C31A6: dissect_ber_sq_of (packet-ber.c:3524)
==10747==  Address 0x131bba71 is 1 bytes inside a block of size 13 free'd
==10747==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10747==    by 0x71F1BFC: wmem_simple_free_all (wmem_allocator_simple.c:107)
==10747==    by 0x71F287B: wmem_leave_packet_scope (wmem_scopes.c:81)
==10747==    by 0x413713: process_packet (tshark.c:3531)
==10747==    by 0x40C871: main (tshark.c:3317)
==10747== 
==10747== 
==10747== HEAP SUMMARY:
==10747==     in use at exit: 1,227,549 bytes in 30,593 blocks
==10747==   total heap usage: 987,216 allocs, 956,623 frees, 63,785,550 bytes
allocated
==10747== 
==10747== LEAK SUMMARY:
==10747==    definitely lost: 12,352 bytes in 1,107 blocks
==10747==    indirectly lost: 36,744 bytes in 51 blocks
==10747==      possibly lost: 0 bytes in 0 blocks
==10747==    still reachable: 1,178,453 bytes in 29,435 blocks
==10747==         suppressed: 0 bytes in 0 blocks
==10747== Rerun with --leak-check=full to see details of leaked memory
==10747== 
==10747== For counts of detected and suppressed errors, rerun with: -v
==10747== ERROR SUMMARY: 39 errors from 6 contexts (suppressed: 0 from 0)

[ no debug trace ]

You are receiving this mail because:

You are watching all bug changes.

Follow-Ups:
- [Wireshark-bugs] [Bug 10787] Buildbot crash output: fuzz-2014-12-16-12596.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 10787] Buildbot crash output: fuzz-2014-12-16-12596.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 10787] Buildbot crash output: fuzz-2014-12-16-12596.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 10787] Buildbot crash output: fuzz-2014-12-16-12596.pcap
  - From: bugzilla-daemon

Prev by Date: [Wireshark-bugs] [Bug 10786] New: VHT NDP announcement frame's STA info field and FCS is not correctly
Next by Date: [Wireshark-bugs] [Bug 10786] VHT NDP announcement frame's STA info field and FCS is not correctly
Previous by thread: [Wireshark-bugs] [Bug 10786] VHT NDP announcement frame's STA info field and FCS is not correctly
Next by thread: [Wireshark-bugs] [Bug 10787] Buildbot crash output: fuzz-2014-12-16-12596.pcap
Index(es):
- Date
- Thread