[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	10844
Summary	Buildbot crash output: fuzz-2015-01-09-27534.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2015-01-09-27534.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-01-09-27534.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/frame_comp.enc

Build host information:
Linux wsbb04 3.13.0-43-generic #72-Ubuntu SMP Mon Dec 8 19:35:06 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3097
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=5e8c053d68e3a6e73417faa838e921457ff4d9e0

Return value:  0

Dissector bug:  0

Valgrind error count:  55



Git commit
commit 5e8c053d68e3a6e73417faa838e921457ff4d9e0
Author: Guy Harris <guy@alum.mit.edu>
Date:   Wed Jan 7 11:43:15 2015 -0800

    Squelch a compiler warning.

    No need for buflen to be bigger than len, which it will be on LP64 and
    LLP64 platforms if it's size_t and len is guint32.

    Change-Id: Iffd2940187180cde1ad55ff7d3bd7c45acf22eba
    Reviewed-on: https://code.wireshark.org/review/6380
    Reviewed-by: Guy Harris <guy@alum.mit.edu>


Command and args: ./tools/valgrind-wireshark.sh 

==22300== Memcheck, a memory error detector
==22300== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==22300== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==22300== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-01-09-27534.pcap
==22300== 
==22300== Use of uninitialised value of size 8
==22300==    at 0x6E53A70: wcp_uncompress (packet-wcp.c:424)
==22300==    by 0x6E53D68: dissect_wcp (packet-wcp.c:378)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x6993748: dissect_fr_nlpid (packet-fr.c:759)
==22300==    by 0x6993E80: dissect_fr_common (packet-fr.c:561)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Conditional jump or move depends on uninitialised value(s)
==22300==    at 0x6A48CEF: dissect_icmp (packet-icmp.c:1305)
==22300==    by 0x66D4A6E: call_dissector_through_handle (packet.c:633)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x6A96174: dissect_ip (packet-ip.c:2426)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x6993748: dissect_fr_nlpid (packet-fr.c:759)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300== 
==22300== Conditional jump or move depends on uninitialised value(s)
==22300==    at 0x699357A: dissect_fr_nlpid (packet-fr.c:668)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x6993748: dissect_fr_nlpid (packet-fr.c:759)
==22300==    by 0x6993E80: dissect_fr_common (packet-fr.c:561)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300== 
==22300== Use of uninitialised value of size 8
==22300==    at 0x9B5A593: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==22300==    by 0x66D5BD8: dissector_try_uint_new (packet.c:1134)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Conditional jump or move depends on uninitialised value(s)
==22300==    at 0x9B5A5CC: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==22300==    by 0x66D5BD8: dissector_try_uint_new (packet.c:1134)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Use of uninitialised value of size 8
==22300==    at 0x9B5A5D6: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==22300==    by 0x66D5BD8: dissector_try_uint_new (packet.c:1134)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Conditional jump or move depends on uninitialised value(s)
==22300==    at 0x9B5A5F2: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==22300==    by 0x66D5BD8: dissector_try_uint_new (packet.c:1134)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Use of uninitialised value of size 8
==22300==    at 0x9B5A659: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==22300==    by 0x66D5BD8: dissector_try_uint_new (packet.c:1134)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Use of uninitialised value of size 8
==22300==    at 0x9B5A641: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==22300==    by 0x66D5BD8: dissector_try_uint_new (packet.c:1134)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300== 
==22300== Conditional jump or move depends on uninitialised value(s)
==22300==    at 0x687C9F7: dissect_clnp (packet-clnp.c:242)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300== 
==22300== Conditional jump or move depends on uninitialised value(s)
==22300==    at 0x6C3D446: dissect_ositp_internal (packet-ositp.c:2142)
==22300==    by 0x66D4A6E: call_dissector_through_handle (packet.c:633)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D7141: call_dissector_with_data (packet.c:2414)
==22300==    by 0x687CA86: dissect_clnp (packet-clnp.c:249)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300==    by 0x66D54C4: call_dissector_work (packet.c:724)
==22300==    by 0x66D5C0B: dissector_try_uint_new (packet.c:1156)
==22300==    by 0x66D5C56: dissector_try_uint (packet.c:1182)
==22300==    by 0x69935A8: dissect_fr_nlpid (packet-fr.c:714)
==22300==    by 0x6993805: dissect_fr_uncompressed (packet-fr.c:650)
==22300==    by 0x66D4A33: call_dissector_through_handle (packet.c:637)
==22300== 
==22300== 
==22300== HEAP SUMMARY:
==22300==     in use at exit: 1,218,402 bytes in 29,726 blocks
==22300==   total heap usage: 226,536 allocs, 196,810 frees, 28,925,720 bytes
allocated
==22300== 
==22300== LEAK SUMMARY:
==22300==    definitely lost: 3,688 bytes in 158 blocks
==22300==    indirectly lost: 20,360 bytes in 50 blocks
==22300==      possibly lost: 16,384 bytes in 1 blocks
==22300==    still reachable: 1,177,970 bytes in 29,517 blocks
==22300==         suppressed: 0 bytes in 0 blocks
==22300== Rerun with --leak-check=full to see details of leaked memory
==22300== 
==22300== For counts of detected and suppressed errors, rerun with: -v
==22300== Use --track-origins=yes to see where uninitialised values come from
==22300== ERROR SUMMARY: 55 errors from 11 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.