Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9072] Enhancement of the packet-mq dissector (WMQ 7.1-7.5)

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 21 on bug 9072 from robionekenobi

(In reply to comment #20)

We also have to initialize the stack_top variable to 0 for to work:

static struct except_stacknode *stack_top = 0;


> (In reply to comment #19)
> 
> Hi,
> 
> if you add an error at the begining of 
> 
> static gboolean dissect_mq_heur(tvbuff_t *tvb, packet_info *pinfo,
> proto_tree *tree, gint iProto, void *data _U_)
> {
> 	int x=5;
> 	int y=0;
> 
> 	x/=y;
> 
> for example, when trying to dissect a MQ packet, the debugger stops at this
> instruction with an access violation.
> 
> If I continue to the next instruction (return top), the pgm continue but
> every packet is displayed
> 
> [Dissector bug, protocol MQ: STATUS_INTEGER_DIVIDE_BY_ZERO: dissector tried
> an integer division by zero]
> 
> and i'm able to stop the pgm.
> 
> If i put the if (top), then there is no more access violation, and the pgm
> display all mq packet with the error
> 
> Here the access violation:
> Unhandled exception at 0x000007FED1CB9F43 (libwireshark.dll) in
> Wireshark.exe: 0xC0000005: Access violation reading location
> 0xFFFFFFFFFFFFFFFF.
> 
> Here the Call Stack:
> >	libwireshark.dll!except_pop() Line 267	C
>  	Wireshark.exe!cf_read(_capture_file * cf=0x000000014014cb80, int
> reloading=0x00000000) Line 716	C
>  	Wireshark.exe!menu_open_recent_file_cmd(_GtkAction *
> action="" Line 4283	C
>  	Wireshark.exe!menu_open_recent_file_cmd_cb(_GtkAction *
> action="" void * data="" Line 4303	C
>  	libgobject-2.0-0.dll!g_closure_invoke() + 329 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_handler_disconnect() + 3351 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_emit_valist() + 2634 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_emit() + 24 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_action_new() + 223 bytes	Unknown
>  	libgobject-2.0-0.dll!g_closure_invoke() + 950 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_emit_valist() + 1023 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_emit() + 24 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_widget_activate() + 112 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_menu_shell_activate_item() + 253 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_menu_shell_activate_item() + 1099 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_marshal_VOID__UINT_STRING() + 279 bytes	Unknown
>  	libgobject-2.0-0.dll!g_closure_invoke() + 329 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_handler_disconnect() + 2729 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_emit_valist() + 2052 bytes	Unknown
>  	libgobject-2.0-0.dll!g_signal_emit() + 24 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_widget_get_realized() + 557 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_propagate_event() + 193 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_main_do_event() + 603 bytes	Unknown
>  	libgdk-win32-2.0-0.dll!gdk_event_get_graphics_expose() + 10027 bytes
> Unknown
>  	libglib-2.0-0.dll!g_main_context_dispatch() + 278 bytes	Unknown
>  	libglib-2.0-0.dll!g_main_context_dispatch() + 1064 bytes	Unknown
>  	libglib-2.0-0.dll!g_main_loop_run() + 115 bytes	Unknown
>  	libgtk-win32-2.0-0.dll!gtk_main() + 158 bytes	Unknown
>  	Wireshark.exe!main(int argc=0x00000000, char * * argv=0x00000000004a88c8)
> Line 3200	C
>  	Wireshark.exe!WinMain(HINSTANCE__ * hInstance=0x000000013fe90000,
> HINSTANCE__ * hPrevInstance=0x0000000000000000, char *
> lpszCmdLine=0x0000000000495a03, int nCmdShow=0x0000000a) Line 3272	C
>  	Wireshark.exe!__tmainCRTStartup() Line 528	C
>  	kernel32.dll!BaseThreadInitThunk()	Unknown
>  	ntdll.dll!RtlUserThreadStart()	Unknown
> 
> So, it seems that somewhere the exception are not yet fully initialized, and
> the test with the if (top) remove the exception
> 
> RobiOneKenobi
> 
> > Comment on attachment 11515 [details]
> > correct an access violation if top is null
> > 
> > My understanding is that if top ends up NULL in this function then you are
> > misusing the exception API somehow - how are you triggering this?

---

      You are receiving this mail because:

• You are watching all bug changes.