Wireshark-bugs: [Wireshark-bugs] [Bug 10476] Consistent crashes reading PCAP from tPacketCapture
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 17 Sep 2014 18:38:49 +0000

Comment # 17 on bug 10476 from 
(In reply to Alex Kirk from comment #16)
> Bill was correct on both fronts. Landed now, and it was in fact Frame 412.
> 
> Identical crash when running with "-C Default". I didn't think I had made
> any config changes on that particular installation.
> 
> As for that pointer - invalid as in NULL, or pointing off somewhere wonky in
> memory? If the latter, my immediate thought would be to see if the value
> retrieved looks like it came from that frame, because if that's the case,
> it's most likely exploitable.

Invalid as we get a non null but wrong pointer (not the address that we pushed
in the TRY block (tshark.c:2092) at the very beginning of the dissection).
To make things clear: it's not the dissection of the last frame on which tshark
chokes, but on the ENDTRY block (tshark.c:2111) once dissection is complete.

You are receiving this mail because:
  • You are watching all bug changes.