Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 3564] New: fuzz testing crashes wireshark in packet-afs.c

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3564

           Summary: fuzz testing crashes wireshark in packet-afs.c
           Product: Wireshark
           Version: SVN
          Platform: x86
        OS/Version: All
            Status: NEW
          Severity: Critical
          Priority: High
         Component: TShark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: yamisoe@xxxxxxxxx


Created an attachment (id=3167)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=3167)
the fuzzed capture file.

Build Information:
TShark 1.3.0 (SVN Rev 28767)

Copyright 1998-2009 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled with GLib 2.20.1, with libpcap 1.0.0, with libz 1.2.3.3, without POSIX
capabilities, without libpcre, without SMI, without c-ares, without ADNS, with
Lua 5.1, without Python, with GnuTLS 2.4.2, with Gcrypt 1.4.1, without
Kerberos,
without GeoIP.
NOTE: this build doesn't support the "matches" operator for Wireshark filter
syntax.

Running on Linux 2.6.28-11-generic, with libpcap version 1.0.0, GnuTLS 2.4.2,
Gcrypt 1.4.1.

Built using gcc 4.3.3.

--
See the attached fuzzed capture.

bt is:

#0  0xb5de68b1 in memcpy () from /lib/tls/i686/cmov/libc.so.6
#1  0xb66a03c6 in dissect_fs_request (tvb=0x9844448, rxinfo=0xbfb7cbc8,
tree=0x9924498, offset=32, opcode=139) at /usr/include/bits/string3.h:52
#2  0xb6692874 in dissect_afs (tvb=0x9844448, pinfo=0x9929928, tree=0x9924900)
at packet-afs.c:1666
#3  0xb6624735 in call_dissector_through_handle (handle=0x92b54e8,
tvb=0x9844448, pinfo=0x9929928, tree=0x9924900) at packet.c:406
#4  0xb6624efe in call_dissector_work (handle=0x92b54e8, tvb=0x9844448,
pinfo_arg=0x9929928, tree=0x9924900, add_proto_name=1) at packet.c:497
#5  0xb662509a in call_dissector (handle=0x92b54e8, tvb=0x9844448,
pinfo=0x9929928, tree=0x9924900) at packet.c:1813
#6  0xb6b59541 in dissect_rx (tvb=0x9844410, pinfo=0x9929928,
parent_tree=0x9924900) at packet-rx.c:586
#7  0xb662476c in call_dissector_through_handle (handle=0x9873f58,
tvb=0x9844410, pinfo=0x9929928, tree=0x9924900) at packet.c:402
#8  0xb6624efe in call_dissector_work (handle=0x9873f58, tvb=0x9844410,
pinfo_arg=0x9929928, tree=0x9924900, add_proto_name=1) at packet.c:497

/* omitted */


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.