| Bug ID |
13203
|
| Summary |
Buildbot crash output: fuzz-2016-12-05-23758.pcap
|
| Product |
Wireshark
|
| Version |
unspecified
|
| Hardware |
x86-64
|
| URL |
https://www.wireshark.org/download/automated/captures/fuzz-2016-12-05-23758.pcap
|
| OS |
Ubuntu
|
| Status |
CONFIRMED
|
| Severity |
Major
|
| Priority |
High
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
[email protected]
|
| Reporter |
[email protected]
|
Problems have been found with the following capture file:
https://www.wireshark.org/download/automated/captures/fuzz-2016-12-05-23758.pcap
stderr:
Input file: /home/wireshark/menagerie/menagerie/11275-cops-fuzz-test.pcap
Build host information:
Linux wsbb04 4.4.0-47-generic #68-Ubuntu SMP Wed Oct 26 19:39:52 UTC 2016
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID: Ubuntu
Description: Ubuntu 16.04.1 LTS
Release: 16.04
Codename: xenial
Buildbot information:
BUILDBOT_REPOSITORY=ssh://[email protected]:29418/wireshark
BUILDBOT_WORKERNAME=clang-code-analysis
BUILDBOT_BUILDNUMBER=3803
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_GOT_REVISION=e0a4f0c79b68830547dab1baad7641a09b4d93f5
Return value: 0
Dissector bug: 0
Valgrind error count: 2
Git commit
commit e0a4f0c79b68830547dab1baad7641a09b4d93f5
Author: Michael Mann <[email protected]>
Date: Sun Dec 4 20:27:35 2016 -0500
SMB: Limit Export object files to 32 bits.
Most of the file offset fields are 32-bit, but the algorithms use gsize
variables, which can vary between 32 and 64 bit builds. The 64-bit
builds are the ones with the problem with "garbage" data comes from
(effectively) invalid 32-bit offsets.
Bug: 11133
Change-Id: I20b8cafb75fc021594159ab092c18c24f3e257e3
Reviewed-on: https://code.wireshark.org/review/19073
Reviewed-by: Michael Mann <[email protected]>
Petri-Dish: Michael Mann <[email protected]>
Tested-by: Petri Dish Buildbot <[email protected]>
Reviewed-by: Anders Broman <[email protected]>
==21894== Memcheck, a memory error detector
==21894== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==21894== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==21894== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2016-12-05-23758.pcap
==21894==
==21894== Conditional jump or move depends on uninitialised value(s)
==21894== at 0x6B9E0F9: dissect_cops_pdu (packet-cops.c:1160)
==21894== by 0x7190C05: tcp_dissect_pdus (packet-tcp.c:3468)
==21894== by 0x6B9CA31: dissect_cops (packet-cops.c:1197)
==21894== by 0x69AEAA5: call_dissector_through_handle (packet.c:650)
==21894== by 0x69AEAA5: call_dissector_work (packet.c:725)
==21894== by 0x69AE96E: dissector_try_uint_new (packet.c:1290)
==21894== by 0x719111F: decode_tcp_ports (packet-tcp.c:5420)
==21894== by 0x719243F: process_tcp_payload (packet-tcp.c:5483)
==21894== by 0x7191998: desegment_tcp (packet-tcp.c:2990)
==21894== by 0x7191998: dissect_tcp_payload (packet-tcp.c:5550)
==21894== by 0x7196407: dissect_tcp (packet-tcp.c:6434)
==21894== by 0x69AEAA5: call_dissector_through_handle (packet.c:650)
==21894== by 0x69AEAA5: call_dissector_work (packet.c:725)
==21894== by 0x69AE96E: dissector_try_uint_new (packet.c:1290)
==21894== by 0x6DDF592: ip_try_dissect (packet-ip.c:1978)
==21894== by 0x6DDF592: dissect_ip_v4 (packet-ip.c:2441)
==21894==
==21894==
==21894== HEAP SUMMARY:
==21894== in use at exit: 6,085,871 bytes in 9,749 blocks
==21894== total heap usage: 266,396 allocs, 256,647 frees, 37,357,569 bytes
allocated
==21894==
==21894== LEAK SUMMARY:
==21894== definitely lost: 504 bytes in 91 blocks
==21894== indirectly lost: 640 bytes in 5 blocks
==21894== possibly lost: 0 bytes in 0 blocks
==21894== still reachable: 6,084,727 bytes in 9,653 blocks
==21894== suppressed: 0 bytes in 0 blocks
==21894== Rerun with --leak-check=full to see details of leaked memory
==21894==
==21894== For counts of detected and suppressed errors, rerun with: -v
==21894== Use --track-origins=yes to see where uninitialised values come from
==21894== ERROR SUMMARY: 2 errors from 1 contexts (suppressed: 0 from 0)
[ no debug trace ]
You are receiving this mail because:
- You are watching all bug changes.