Wireshark · Ethereal-dev: Re: Re: [Ethereal-dev] Ethereal 0.99.0 epan/strutil.c - utf_8to16 bug

[<jdhagen@xxxxxxxxxx>]

Ulf,

The string passed to the function is:

"C:\Program Files\Ethereal\dumpcap" -i \Device\NPF_{66E7710E-054E-408F-91A2-29B8AD1BDEDB} -Z -B 1 -f "ether host 00:14:22:CD:FD:42"

The string length exceeds INITIAL_FMTBUF_SIZE, so the
g_realloc logic triggers.  However, the buffer is half
the size it should be because it doesn't account for
the size of wchar_t, resulting in the access violation.

Ironically, the call to g_malloc before this is correct:

   utf16buf[idx] = g_malloc(utf16buf_len[idx] * sizeof(wchar_t));

So the failure only occurs if the length of utf8str
exceeds INITIAL_FMTBUF_SIZE.


Joe
> 
> From: Ulf Lamping <ulf.lamping@xxxxxx>
> Date: 2006/04/27 Thu AM 07:43:02 GMT
> To: Ethereal development <ethereal-dev@xxxxxxxxxxxx>
> Subject: Re: [Ethereal-dev] Ethereal 0.99.0 epan/strutil.c - utf_8to16 bug
> 
> Joe Hagen wrote:
> > I believe the utf_8to16 function in epan/strutil.c
> > has a bug.  I've experienced access violations
> > with version 0.99.0 when starting a capture that
> > point to this function.
> >
> > I performed tests using Windows XP SP2 and
> > used the gflags program to enable page heap
> > checking on ethereal.exe.
> >
> > The fault actually occurs in the Win32 function
> > MultiByteToWideChar, but occurs because this
> > code:
> >
> >   utf16buf[idx] = g_realloc(utf16buf[idx], utf16buf_len[idx]);
> >
> > doesn't account for the sizeof(wchar_t) when allocating
> > memory, resulting in an access violation.  The buffer
> > passed to MultiByteToWideChar is too small.
> >
> The code in the utf_8to16() function seems to be looking ok at first sight.
> 
> I would guess the problem is caused by an invalid utf8str string given 
> to that function. Could you provide a call stack and an explanation what 
> you've done to trigger that bug?
> 
> As this is obviously a bug, could you add a bug report to 
> http://bugs.ethereal.com/bugzilla/ ?
> 
> Regards, ULFL
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>