Ethereal-dev: Re: [ethereal-dev] Crash in proto.c

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Tue, 16 May 2000 08:25:13 -0500
On Tue, May 16, 2000 at 12:22:55PM +0200, Gregor Glomm wrote:
> Hi there,
> 
> I have found a problem with the Version 0.8.8 of ethereal.
> I am using the nbipx filter and ethereal stops.
> Here is a  bt from the crash.
> By,

Thanks for the debugger output. Please try this patch. It
should stop the crash. But then I'm interested in what happens
if you create a display filter on this 0-length field.

Can you try this display filter:

bootp.hw.addr == ff.ff.ff.ff.ff.ff

Please tell me if it crashes or not. :-) Thanks.

--gilbert
--- proto.c.orig	Tue May 16 08:15:17 2000
+++ proto.c	Tue May 16 08:19:28 2000
@@ -497,11 +497,16 @@
 proto_tree_set_bytes(field_info *fi, const guint8* start_ptr, gint length)
 {
 	g_assert(start_ptr != NULL);
-	g_assert(length > 0);
-	/* This g_malloc'ed memory is freed in
-	   proto_tree_free_node() */
-	fi->value.bytes = g_malloc(length);
-	memcpy(fi->value.bytes, start_ptr, length);
+
+	if (length > 0) {
+		/* This g_malloc'ed memory is freed in
+		   proto_tree_free_node() */
+		fi->value.bytes = g_malloc(length);
+		memcpy(fi->value.bytes, start_ptr, length);
+	}
+	else {
+		fi->value.bytes = NULL;
+	}
 }
 
 /* Add a FT_*TIME to a proto_tree */
@@ -1078,9 +1083,14 @@
 			break;
 
 		case FT_BYTES:
-			snprintf(label_str, ITEM_LABEL_LENGTH,
-				"%s: %s", hfinfo->name, 
-				 bytes_to_str(fi->value.bytes, fi->length));
+			if (fi->value.bytes) {
+				snprintf(label_str, ITEM_LABEL_LENGTH,
+					"%s: %s", hfinfo->name, 
+					 bytes_to_str(fi->value.bytes, fi->length));
+			}
+			else {
+				snprintf(label_str, ITEM_LABEL_LENGTH,
+					"%s: <MISSING>", hfinfo->name);
 			break;
 
 		/* Four types of integers to take care of:
--- packet-bootp.c.orig	Tue May 16 08:09:35 2000
+++ packet-bootp.c	Tue May 16 08:21:49 2000
@@ -615,12 +615,17 @@
 		proto_tree_add_item(bp_tree, hf_bootp_ip_relay,
 				    offset + 24, 4, ip_addr);
 
-		proto_tree_add_bytes_format(bp_tree, hf_bootp_hw_addr, 
-					   offset + 28, pd[offset+2],
-					   &pd[offset+28],
-					   "Client hardware address: %s",
-					   arphrdaddr_to_str((guint8*)&pd[offset+28],
-							     pd[offset+2], pd[offset+1]));
+		if (pd[offset+2] > 0) {
+			proto_tree_add_bytes_format(bp_tree, hf_bootp_hw_addr, 
+						   offset + 28, pd[offset+2], &pd[offset+28],
+						   "Client hardware address: %s",
+						   arphrdaddr_to_str((guint8*)&pd[offset+28],
+								     pd[offset+2], pd[offset+1]));
+		}
+		else {
+			proto_tree_add_bytes(bp_tree, hf_bootp_hw_addr, 
+						   offset + 28, 0, NULL);
+		}
 
 		/* The server host name is optional */
 		if (pd[offset+44]) {