Wireshark-bugs: [Wireshark-bugs] [Bug 9980] Capture filter "ether host ::" crash
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 10 Apr 2014 20:33:30 +0000

changed bug 9980

What Removed Added
Status UNCONFIRMED RESOLVED
Resolution --- NOTOURBUG

Comment # 1 on bug 9980 from 
That's correct, and the parser is part of WinPcap, not part of Wireshark.

This is fixed in recent versions of libpcap.  The problem is that, unless you
have 6 octets separated by colons, the address is treated by the parser as an
IPv6 address, not a MAC address, and the BPF code generator was not explicitly
checking for an IPv6 address being used with "ether host", and was thus
treating it as a "this can't possibly happen, I'm going to crash" case; it was
fixed to report "link-layer modifier applied to ip6 host".

Unfortunately, there is not currently a version of WinPcap based on a recent
version of libpcap, so, on Windows, there's no version of WinPcap that will
report "link-layer modifier applied to ip6 host" rather than crashing.

You are receiving this mail because:
  • You are watching all bug changes.