Wireshark · Ethereal-dev: Re: [Ethereal-dev] Ethereal 0.9.1 segfault during filtering (w/gdb backtrace)

[Guy Harris <guy@xxxxxxxxxx>]

> Loaded a ~160M tcpdump from our lan, then did a "follow tcp stream" on a
> random stream near the end. It aborts with this:
> 
> erik@maskingreie:~$ ethereal -r /mnt/monster/LANet-8-feb-2002.tcpdump
> 
> ** ERROR **: file proto.c: line 1613 (alloc_field_info): assertion failed:
> (tvb != NULL || length == 0)
> aborting...
> Aborted (core dumped)

(That's an abort rather than a segfault.)

Do you still have the capture file?

> A backtrace:

	...

> #7  0x8144516 in dissect_mailslot_smb (mshdr_tvb=0x0, setup_tvb=0x0,
> tvb=0x84753d0, mailslot=0x0,
>     pinfo=0xa056da8, parent_tree=0x847a514) at packet-smb-mailslot.c:134

If you go into GDB on that core dump, and do

	frame 7

followed by

	print pinfo->fd->num

what gets printed?  That'll be the frame number of the offending frame;
you can use editcap to generate a capture file that has that frame and,
say, 99 frames before it - if the number was 173042, for example, the
command

	editcap -r 172942-173042 {input} {output}

where {input} is the file name of the 160MB capture and {output} is the
name of the output file, should do it.

Try that and see if the problem occurs on that file as well.