Wireshark · Ethereal-dev: [Ethereal-dev] Ethereal crash when dissect H450 message

["Zhao, Allen Weitao (Allen)" <allenz@xxxxxxxxxx>]

List, 

I am new to this list. Currently, my ethereal crashed during dissectting H245 message.  The ethereal used is ver0.10.0C windows build.   I have also tried the code on 2/13/2004 on RedHat Linux 8.0, it is same.

Following is the trace: 

** ERROR **: file proto.c: line 1681 (proto_tree_add_uint): should not be reached
aborting...

Program received signal SIGABRT, Aborted.
0x400ffae1 in __kill () from /lib/i686/libc.so.6
(gdb) where
#0  0x400ffae1 in __kill () from /lib/i686/libc.so.6
#1  0x400ff8ba in raise (sig=6) at ../sysdeps/posix/raise.c:27
#2  0x40101062 in abort () at ../sysdeps/generic/abort.c:88
#3  0x4009a09c in g_logv () at eval.c:41
#4  0x4009a147 in g_log () at eval.c:41
#5  0x82fcac3 in proto_tree_add_uint (tree=0x883b390, hfindex=5763,
    tvb=0x883b6d4, start=0, length=1, value=1) at proto.c:1681
#6  0x82003d8 in dissect_per_constrained_integer (tvb=0x883b6d4, offset=0,
    pinfo=0x883aa58, tree=0x883b390, hf_index=5763, min=0, max=1,
    value=0xbfffdbd0, item=0xbfffdbd4, has_extension=0) at packet-per.c:811
#7  0x8200a6d in dissect_per_choice (tvb=0x883b6d4, offset=0, pinfo=0x883aa58,
    tree=0x883af58, hf_index=5763, ett_index=3086, choice=0x866b100,
    name=0x844f952 "DummyRes", value=0x0) at packet-per.c:975
#8  0x816c825 in dissect_h4502_DummyRes (tvb=0x883b6d4, offset=0,
    pinfo=0x883aa58, tree=0x883af58) at packet-h450.c:747
#9  0x816c8ac in dissect_h4501_ReturnResult_result (tvb=0x883b6a0, offset=72,
    pinfo=0x883aa58, tree=0x883af58) at packet-h450.c:771
#10 0x8200d95 in dissect_per_sequence (tvb=0x883b6a0, offset=48,
    pinfo=0x883aa58, parent_tree=0x8884020, hf_index=5766, ett_index=3069,
    sequence=0x866b4a0) at packet-per.c:1183
#11 0x816c93e in dissect_h4501_result (tvb=0x883b6a0, offset=48,
    pinfo=0x883aa58, tree=0x8884020) at packet-h450.c:794
#12 0x8200d95 in dissect_per_sequence (tvb=0x883b6a0, offset=18,
    pinfo=0x883aa58, parent_tree=0x883ad60, hf_index=5767, ett_index=3070,
---Type <return> to continue, or q <return> to quit---q
sequeQuit
) at packet-per.c:1183
#13 0x816c97e in dissect_h4501_ReturnResult (tvb=0x883b6a0, offset=18,
    pinfo=0x883aa58, tree=0x883ad60) at packet-h450.c:809
#14 0x8200ac9 in dissect_per_choice (tvb=0x883b6a0, offset=16,
    pinfo=0x883aa58, tree=0x8884530, hf_index=5778, ett_index=3075,
    choice=0x866b640, name=0x844ff08 "ROS", value=0x0) at packet-per.c:992
#15 0x816cbe5 in dissect_h4501_ROS (tvb=0x883b6a0, offset=16, pinfo=0x883aa58,
    tree=0x8884530) at packet-h450.c:1026
#16 0x81ff6b2 in dissect_per_sequence_of_helper (tvb=0x883b6a0, offset=16,
    pinfo=0x883aa58, tree=0x883b3f0, func=0x816cbb0 <dissect_h4501_ROS>,
    length=1) at packet-per.c:222
#17 0x81ff778 in dissect_per_sequence_of (tvb=0x883b6a0, offset=4,
    pinfo=0x883aa58, parent_tree=0x883b210, hf_index=5779, ett_index=3076,
    func=0x816cbb0 <dissect_h4501_ROS>) at packet-per.c:250
#18 0x816cc1e in dissect_h4501_rosApdus (tvb=0x883b6a0, offset=4,
    pinfo=0x883aa58, tree=0x883b210) at packet-h450.c:1034
#19 0x8200ac9 in dissect_per_choice (tvb=0x883b6a0, offset=3, pinfo=0x883aa58,
    tree=0x883b450, hf_index=5780, ett_index=3077, choice=0x866b6a0,
    name=0x844ff28 "ServiceApdus", value=0x0) at packet-per.c:992
#20 0x816cc65 in dissect_h4501_ServiceApdus (tvb=0x883b6a0, offset=3,
    pinfo=0x883aa58, tree=0x883b450) at packet-h450.c:1051
#21 0x8200d95 in dissect_per_sequence (tvb=0x883b6a0, offset=0,
    pinfo=0x883aa58, parent_tree=0x883aec8, hf_index=5729, ett_index=3058,
    sequence=0x866b6c0) at packet-per.c:1183
---Type <return> to continue, or q <return> to quit---
#22 0x816cccd in dissect_h4501 (tvb=0x883b6a0, pinfo=0x883aa58, tree=0x883b300)
    at packet-h450.c:1075
#23 0x82f947c in call_dissector_through_handle (handle=0x8760af8,
    tvb=0x883b6a0, pinfo=0x883aa58, tree=0x883b300) at packet.c:363
#24 0x82f97e5 in call_dissector_work (handle=0x8760af8, tvb=0x883b6a0,
    pinfo=0x883aa58, tree=0x883b300) at packet.c:513
#25 0x82faa9e in call_dissector (handle=0x8760af8, tvb=0x883b6a0,
    pinfo=0x883aa58, tree=0x883b300) at packet.c:1596
#26 0x815c774 in dissect_h225_h4501SupplementaryService_item (tvb=0x883b66c,
    offset=264, pinfo=0x883aa58, tree=0x883b300) at packet-h225.c:7875
#27 0x81ff6b2 in dissect_per_sequence_of_helper (tvb=0x883b66c, offset=264,
    pinfo=0x883aa58, tree=0x8884218,
    func=0x815c710 <dissect_h225_h4501SupplementaryService_item>, length=1)
    at packet-per.c:222
#28 0x81ff778 in dissect_per_sequence_of (tvb=0x883b66c, offset=256,
    pinfo=0x883aa58, parent_tree=0x883af40, hf_index=4719, ett_index=2556,
    func=0x815c710 <dissect_h225_h4501SupplementaryService_item>)
    at packet-per.c:250
#29 0x815c7bd in dissect_h225_h4501SupplementaryService (tvb=0x883b66c,
    offset=256, pinfo=0x883aa58, tree=0x883af40) at packet-h225.c:7883
#30 0x8200fd4 in dissect_per_sequence (tvb=0x883b66c, offset=2,
    pinfo=0x883aa58, parent_tree=0x8884368, hf_index=4718, ett_index=2555,
    sequence=0x864d0a0) at packet-per.c:1276
#31 0x815c99d in dissect_h225_H323_UU_PDU (tvb=0x883b66c, offset=2,
---Type <return> to continue, or q <return> to quit---
    pinfo=0x883aa58, tree=0x8884368) at packet-h225.c:7987
#32 0x8200d95 in dissect_per_sequence (tvb=0x883b66c, offset=0,
    pinfo=0x883aa58, parent_tree=0x8884158, hf_index=4744, ett_index=2570,
    sequence=0x864d8c0) at packet-per.c:1183
#33 0x815d087 in dissect_h225_H323UserInformation (tvb=0x883b66c,
    pinfo=0x883aa58, tree=0x883aeb0) at packet-h225.c:8499
#34 0x82f947c in call_dissector_through_handle (handle=0x874a020,
    tvb=0x883b66c, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:363
#35 0x82f97e5 in call_dissector_work (handle=0x874a020, tvb=0x883b66c,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:513
#36 0x82faa9e in call_dissector (handle=0x874a020, tvb=0x883b66c,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:1596
#37 0x8211ef5 in dissect_q931_pdu (tvb=0x883b638, pinfo=0x883aa58,
    tree=0x883aeb0, is_tpkt=1) at packet-q931.c:2511
#38 0x82122e9 in dissect_q931_tpkt_pdu (tvb=0x883b638, pinfo=0x883aa58,
    tree=0x883aeb0) at packet-q931.c:2839
#39 0x82f947c in call_dissector_through_handle (handle=0x8783bd0,
    tvb=0x883b638, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:363
#40 0x82f97e5 in call_dissector_work (handle=0x8783bd0, tvb=0x883b638,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:513
#41 0x82faa9e in call_dissector (handle=0x8783bd0, tvb=0x883b638,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:1596
#42 0x828bd88 in dissect_tpkt_encap (tvb=0x883b59c, pinfo=0x883aa58,
    tree=0x883aeb0, desegment=1, subdissector_handle=0x8783bd0)
---Type <return> to continue, or q <return> to quit---
    at packet-tpkt.c:298
#43 0x82122bb in dissect_q931_tpkt (tvb=0x883b59c, pinfo=0x883aa58,
    tree=0x883aeb0) at packet-q931.c:2799
#44 0x82fa662 in dissector_try_heuristic (sub_dissectors=0x87b7630,
    tvb=0x883b59c, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:1449
#45 0x8285b96 in decode_tcp_ports (tvb=0x883b568, offset=32, pinfo=0x883aa58,
    tree=0x883aeb0, src_port=1720, dst_port=1025) at packet-tcp.c:2308
#46 0x8285cba in process_tcp_payload (tvb=0x883b568, offset=32,
    pinfo=0x883aa58, tree=0x883aeb0, tcp_tree=0x883af88, src_port=1720,
    dst_port=1025, nxtseq=447, is_tcp_segment=1) at packet-tcp.c:2334
#47 0x8285dbe in dissect_tcp_payload (tvb=0x883b568, pinfo=0x883aa58,
    offset=32, seq=361, nxtseq=447, sport=1720, dport=1025, tree=0x883aeb0,
    tcp_tree=0x883af88) at packet-tcp.c:2406
#48 0x828699d in dissect_tcp (tvb=0x883b568, pinfo=0x883aa58, tree=0x883aeb0)
    at packet-tcp.c:2796
#49 0x82f947c in call_dissector_through_handle (handle=0x87efc00,
    tvb=0x883b568, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:363
#50 0x82f97e5 in call_dissector_work (handle=0x87efc00, tvb=0x883b568,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:513
#51 0x82f9b72 in dissector_try_port (sub_dissectors=0x8759940, port=6,
    tvb=0x883b568, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:777
#52 0x817da19 in dissect_ip (tvb=0x883b534, pinfo=0x883aa58, tree=0x883aeb0)
    at packet-ip.c:1094
#53 0x82f947c in call_dissector_through_handle (handle=0x8759a60,
---Type <return> to continue, or q <return> to quit---
    tvb=0x883b534, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:363
#54 0x82f97e5 in call_dissector_work (handle=0x8759a60, tvb=0x883b534,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:513
#55 0x82f9b72 in dissector_try_port (sub_dissectors=0x8744c28, port=2048,
    tvb=0x883b534, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:777
#56 0x8118518 in ethertype (etype=2048, tvb=0x883b500, offset_after_etype=14,
    pinfo=0x883aa58, tree=0x883aeb0, fh_tree=0x883af10, etype_id=2863,
    trailer_id=2865, fcs_len=-1) at packet-ethertype.c:176
#57 0x8117d87 in dissect_eth_common (tvb=0x883b500, pinfo=0x883aa58,
    tree=0x883aeb0, fcs_len=-1) at packet-eth.c:282
#58 0x8117ecd in dissect_eth_maybefcs (tvb=0x883b500, pinfo=0x883aa58,
    tree=0x883aeb0) at packet-eth.c:377
#59 0x82f947c in call_dissector_through_handle (handle=0x87bad30,
    tvb=0x883b500, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:363
#60 0x82f97e5 in call_dissector_work (handle=0x87bad30, tvb=0x883b500,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:513
#61 0x82f9b72 in dissector_try_port (sub_dissectors=0x873f4c0, port=1,
    tvb=0x883b500, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:777
#62 0x8131a46 in dissect_frame (tvb=0x883b500, pinfo=0x883aa58, tree=0x883aeb0)
    at packet-frame.c:185
#63 0x82f947c in call_dissector_through_handle (handle=0x873f550,
    tvb=0x883b500, pinfo=0x883aa58, tree=0x883aeb0) at packet.c:363
#64 0x82f97e5 in call_dissector_work (handle=0x873f550, tvb=0x883b500,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:513
---Type <return> to continue, or q <return> to quit---
#65 0x82faa9e in call_dissector (handle=0x873f550, tvb=0x883b500,
    pinfo=0x883aa58, tree=0x883aeb0) at packet.c:1596
#66 0x82f9411 in dissect_packet (edt=0x883aa50, pseudo_header=0x8815c64,
    pd=0x8824ca8 "", fd=0xbffff930, cinfo=0x0) at packet.c:311
#67 0x82e131e in wtap_dispatch_cb_print (user=0xbffff9f8 " Jq\b",
    phdr=0x8815c50, offset=12000, pseudo_header=0x8815c64, buf=0x8824ca8 "")
    at tethereal.c:2537
#68 0x82ef3a6 in wtap_loop (wth=0x8815c38, count=0,
    callback=0x82e1270 <wtap_dispatch_cb_print>, user=0xbffff9f8 " Jq\b",
    err=0xbffffa04) at wtap.c:360
#69 0x82e0e0a in load_cap_file (cf=0x8714ac0, out_file_type=2)
    at tethereal.c:2236
#70 0x82df7a5 in main (argc=4, argv=0xbffffc04) at tethereal.c:1471
#71 0x400ed627 in __libc_start_main (main=0x82dea90 <main>, argc=4,
    ubp_av=0xbffffc04, init=0x806a798 <_init>, fini=0x83395ec <_fini>,
    rtld_fini=0x4000dcc4 <_dl_fini>, stack_end=0xbffffbfc)
    at ../sysdeps/generic/libc-start.c:129


Would some one please help me? 

Thanks 

Allen Zhao