Wireshark-bugs: [Wireshark-bugs] [Bug 7085] Buildbot crash output: fuzz-2012-04-14-9084.pcap
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7085
Cristian Constantin <const.crist@xxxxxxxxxxxxxx> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |const.crist@xxxxxxxxxxxxxx
--- Comment #12 from Cristian Constantin <const.crist@xxxxxxxxxxxxxx> 2012-04-15 10:51:44 PDT ---
(In reply to comment #3)
> My analysis:
> - conversation->last is set only for first item
> - for all other elements it's NULL (or random when scrubbing enabled)
>
> In conversation_set_addr2(), conversation_set_port2() we can add *any*
> conversation to other hashtable.
>
> (by any I mean that it can have ->last set to NULL/random)
>
> If memory is scrubbed it will sigsegv in find_or_create_conversation():
> #v+
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff51dc039 in conversation_lookup_hashtable (hashtable=0x1b5f4c0,
> frame_num=3, addr1=0x7fffffffc698, addr2=0x7fffffffc6a8, ptype=PT_TCP,
> port1=3398, port2=6087)
> at conversation.c:726
> 726
> if((match->last)&&(match->last->setup_frame<=frame_num))
> (gdb) print match->last
> $1 = (struct conversation *) 0xbaddcafebaddcafe
> #v-
>
> If memory is zeroed it will sigsegv in conversation_new()
> #v+
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff51dba47 in conversation_new (setup_frame=3, addr1=0x7fffffffc6b8,
> addr2=0x7fffffffc6c8, ptype=PT_TCP, port1=3398, port2=6087, options=0) at
> conversation.c:568
> 568 if(setup_frame>=conversation->last->setup_frame) {
> (gdb) print conversation->last
> $1 = (struct conversation *) 0x0
> #v-
cristian: I am having a look.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
