Wireshark-dev: Re: [Wireshark-dev] Finding the bug in the unistim dissector

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 15 Aug 2007 21:29:28 +0200
Hi,

Yeah, that was my first idea as well. Finding the object that gets altered isn't so easy though. Looking back at the code there are just your basic proto_tree_add_* calls, but there are two extra display handling functions which look oke, but may be the cause after all....

Thanx,
Jaap

Luis EG Ontanon wrote:
Might be a buffer overflow overwriting it.

- break after protocol registration.
- find the object that gets altered,
- set a watchpoint on that memory location
- continue until the watchpoint tells you who and where it gets overwritten.

Luis

On 8/15/07, Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:
Hi list,

I've picked up the unistim dissector a while ago and try getting it into
shape for checkin. Thing is that I'm currently running fuzztests which
for the most run fine, but now I've isolated a packet that causes a
segmentation fault. The problem is that I'm stuck looking for the cause.