Wireshark-bugs: [Wireshark-bugs] [Bug 9761] Null pointer dereference in Cairo if 50, 000 charact
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 03 Sep 2014 10:12:17 +0000

changed bug 9761


What Removed Added
CC   siddharths@fedoraproject.org

Comment # 5 on bug 9761 from 
It doesnt seems to be cairo issue.

following code in simple_dialog.c , causes crash the argument ap is va_list
(Variable Argument Lists) which is used when a function can accept any number
of values, the number of arguments are unkown at compile time. putting 50,000
"A" s causes the corruption in va_list which lead to crash of program while
executing the code

message = g_strdup_vprintf(msg_format, ap);

$17 = {_flags = 219, _IO_read_ptr = 0x7fc291d9f30e "g_strdup_vprintf",
_IO_read_end = 0x7fc291d89188 "", _IO_read_base = 0x0, _IO_write_base = 0x0,
_IO_write_ptr = 0x7fc291d86b38 "", _IO_write_end = 0x7fc291d9d829
"report_failure", _IO_buf_base = 0x7fc28dbc61f8 "", 
  _IO_buf_end = 0x7fc291d8f2d0 "\251\024", _IO_save_base = 0x500000000 <Address
0x500000000 out of bounds>, _IO_backup_base = 0x100000315 <Address 0x100000315
out of bounds>, _IO_save_end = 0x20 <Address 0x20 out of bounds>, _markers =
0x7fc28b541e80, _chain = 
    0x7fc291d894e0, _fileno = -1950316992, _flags2 = 32706, _old_offset =
140473647167928, _cur_column = 37256, _vtable_offset = -40 '\330', _shortbuf =
"\221", _lock = 0x0, _offset = 3562113576, _codecvt = 0x5, _wide_data =
0x4512f0, _freeres_list = 0x0, _freeres_buf = 
    0x7fc2947ba9f0, _freeres_size = 140473670547440, _mode = -1848074240,
_unused2 =
"\302\177\000\000\360_\267\221\302\177\000\000\005\000\000\000\000\000\000"}

Submitting 50,000 A's into the the filter text box causes corruption scrambling
the text on the Wireshark GUI this is because the va_list which stores all the
strings are corrupted.

You are receiving this mail because:
  • You are watching all bug changes.