Wireshark-bugs: [Wireshark-bugs] [Bug 11064] New: Buildbot crash output: fuzz-2015-03-16-14974.p

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 17 Mar 2015 22:10:02 +0000
Bug ID 11064
Summary Buildbot crash output: fuzz-2015-03-16-14974.pcap
Product Wireshark
Version unspecified
Hardware x86-64
URL https://www.wireshark.org/download/automated/captures/fuzz-2015-03-16-14974.pcap
OS Ubuntu
Status CONFIRMED
Severity Major
Priority High
Component Dissection engine (libwireshark)
Assignee [email protected]
Reporter [email protected] 

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-03-16-14974.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/frame_comp.enc

Build host information:
Linux wsbb04 3.13.0-45-generic #74-Ubuntu SMP Tue Jan 13 19:36:28 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.2 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=
BUILDBOT_BUILDNUMBER=3176
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=77d9a059fe2d125a8cfe2193a09804a3e48caf06

Return value:  0

Dissector bug:  0

Valgrind error count:  20



Git commit
commit 77d9a059fe2d125a8cfe2193a09804a3e48caf06
Author: Michal Labedzki <[email protected]>
Date:   Sun Mar 8 14:59:32 2015 +0100

    Qt: Fix DecodeAs

    Previously DecodeAs neither save its changes nor changes dissector tables.
    Do that and redissect packets to refresh view.

    Bug: 10553
    Change-Id: Icd8453c9650f0265852f6b6b58bc483b35570a15
    Reviewed-on: https://code.wireshark.org/review/7676
    Petri-Dish: Michal Labedzki <[email protected]>
    Tested-by: Petri Dish Buildbot <[email protected]>
    Reviewed-by: Michal Labedzki <[email protected]>


Command and args: ./tools/valgrind-wireshark.sh 

==24561== Memcheck, a memory error detector
==24561== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==24561== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==24561== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-03-16-14974.pcap
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0x6A9F8C4: dissect_icmp (packet-icmp.c:1288)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6AEC554: dissect_ip (packet-ip.c:2425)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E7098: dissect_fr_nlpid (packet-fr.c:759)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561== 
==24561== Use of uninitialised value of size 8
==24561==    at 0xA8D79F1: _itoa_word (_itoa.c:180)
==24561==    by 0xA8DB6F6: vfprintf (vfprintf.c:1660)
==24561==    by 0xA997DC4: __vsnprintf_chk (vsnprintf_chk.c:63)
==24561==    by 0x671A6BA: expert_set_info_vformat (expert.c:485)
==24561==    by 0x671B27F: expert_add_info_format (expert.c:569)
==24561==    by 0x6A9F9DC: dissect_icmp (packet-icmp.c:1296)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6AEC554: dissect_ip (packet-ip.c:2425)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0xA8D79F8: _itoa_word (_itoa.c:180)
==24561==    by 0xA8DB6F6: vfprintf (vfprintf.c:1660)
==24561==    by 0xA997DC4: __vsnprintf_chk (vsnprintf_chk.c:63)
==24561==    by 0x671A6BA: expert_set_info_vformat (expert.c:485)
==24561==    by 0x671B27F: expert_add_info_format (expert.c:569)
==24561==    by 0x6A9F9DC: dissect_icmp (packet-icmp.c:1296)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6AEC554: dissect_ip (packet-ip.c:2425)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0xA8DB742: vfprintf (vfprintf.c:1660)
==24561==    by 0xA997DC4: __vsnprintf_chk (vsnprintf_chk.c:63)
==24561==    by 0x671A6BA: expert_set_info_vformat (expert.c:485)
==24561==    by 0x671B27F: expert_add_info_format (expert.c:569)
==24561==    by 0x6A9F9DC: dissect_icmp (packet-icmp.c:1296)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6AEC554: dissect_ip (packet-ip.c:2425)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0xA8D8659: vfprintf (vfprintf.c:1660)
==24561==    by 0xA997DC4: __vsnprintf_chk (vsnprintf_chk.c:63)
==24561==    by 0x671A6BA: expert_set_info_vformat (expert.c:485)
==24561==    by 0x671B27F: expert_add_info_format (expert.c:569)
==24561==    by 0x6A9F9DC: dissect_icmp (packet-icmp.c:1296)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6AEC554: dissect_ip (packet-ip.c:2425)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0xA8D86DC: vfprintf (vfprintf.c:1660)
==24561==    by 0xA997DC4: __vsnprintf_chk (vsnprintf_chk.c:63)
==24561==    by 0x671A6BA: expert_set_info_vformat (expert.c:485)
==24561==    by 0x671B27F: expert_add_info_format (expert.c:569)
==24561==    by 0x6A9F9DC: dissect_icmp (packet-icmp.c:1296)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6AEC554: dissect_ip (packet-ip.c:2425)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0x69E6ECA: dissect_fr_nlpid (packet-fr.c:668)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E7098: dissect_fr_nlpid (packet-fr.c:759)
==24561==    by 0x69E77D0: dissect_fr_common (packet-fr.c:561)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561== 
==24561== Use of uninitialised value of size 8
==24561==    at 0x9C43593: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==24561==    by 0x6724E38: dissector_try_uint_new (packet.c:1110)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0x9C435CC: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==24561==    by 0x6724E38: dissector_try_uint_new (packet.c:1110)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561== 
==24561== Use of uninitialised value of size 8
==24561==    at 0x9C435D6: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==24561==    by 0x6724E38: dissector_try_uint_new (packet.c:1110)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0x9C435F2: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==24561==    by 0x6724E38: dissector_try_uint_new (packet.c:1110)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561== 
==24561== Use of uninitialised value of size 8
==24561==    at 0x9C43659: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==24561==    by 0x6724E38: dissector_try_uint_new (packet.c:1110)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561== 
==24561== Use of uninitialised value of size 8
==24561==    at 0x9C43641: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==24561==    by 0x6724E38: dissector_try_uint_new (packet.c:1110)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0x68D0397: dissect_clnp (packet-clnp.c:241)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561== 
==24561== Conditional jump or move depends on uninitialised value(s)
==24561==    at 0x6C9626E: dissect_ositp_internal (packet-ositp.c:2136)
==24561==    by 0x6723D8E: call_dissector_through_handle (packet.c:612)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x67263A1: call_dissector_with_data (packet.c:2386)
==24561==    by 0x68D0426: dissect_clnp (packet-clnp.c:248)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561==    by 0x6724724: call_dissector_work (packet.c:700)
==24561==    by 0x6724E6B: dissector_try_uint_new (packet.c:1132)
==24561==    by 0x6724EB6: dissector_try_uint (packet.c:1158)
==24561==    by 0x69E6EF8: dissect_fr_nlpid (packet-fr.c:714)
==24561==    by 0x69E7155: dissect_fr_uncompressed (packet-fr.c:650)
==24561==    by 0x6723D53: call_dissector_through_handle (packet.c:614)
==24561== 
==24561== 
==24561== HEAP SUMMARY:
==24561==     in use at exit: 1,222,128 bytes in 29,854 blocks
==24561==   total heap usage: 231,704 allocs, 201,850 frees, 30,617,888 bytes
allocated
==24561== 
==24561== LEAK SUMMARY:
==24561==    definitely lost: 3,352 bytes in 144 blocks
==24561==    indirectly lost: 36,968 bytes in 51 blocks
==24561==      possibly lost: 0 bytes in 0 blocks
==24561==    still reachable: 1,181,808 bytes in 29,659 blocks
==24561==         suppressed: 0 bytes in 0 blocks
==24561== Rerun with --leak-check=full to see details of leaked memory
==24561== 
==24561== For counts of detected and suppressed errors, rerun with: -v
==24561== Use --track-origins=yes to see where uninitialised values come from
==24561== ERROR SUMMARY: 20 errors from 15 contexts (suppressed: 0 from 0)

[ no debug trace ]

You are receiving this mail because:
  • You are watching all bug changes.