Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10655] New: Buildbot crash output: fuzz-2014-10-31-21006.pcap

Wireshark-bugs: [Wireshark-bugs] [Bug 10655] New: Buildbot crash output: fuzz-2014-10-31-21006.p

Date: Sun, 02 Nov 2014 08:40:03 +0000

Bug ID	10655
Summary	Buildbot crash output: fuzz-2014-10-31-21006.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2014-10-31-21006.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2014-10-31-21006.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/cmp-trace.pcap.gz

Build host information:
Linux wsbb04 3.13.0-39-generic #66-Ubuntu SMP Tue Oct 28 13:30:27 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3038
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=d93be95fc0e7011e8b4ade9171e7e66146063296

Return value:  0

Dissector bug:  0

Valgrind error count:  94



Git commit
commit d93be95fc0e7011e8b4ade9171e7e66146063296
Author: AndersBroman <anders.broman@ericsson.com>
Date:   Fri Oct 31 15:13:36 2014 +0100

    Clean up handling of BDC coded numbers a bit.

    Change-Id: Ic3d523664e3c78b4ed289b7e5acf3f53614c6d54
    Reviewed-on: https://code.wireshark.org/review/5027
    Reviewed-by: Anders Broman <a.broman58@gmail.com>


Command and args: ./tools/valgrind-wireshark.sh 

==21480== Memcheck, a memory error detector
==21480== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==21480== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==21480== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2014-10-31-21006.pcap
==21480== 
==21480== Invalid read of size 1
==21480==    at 0x9AC4FE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x9AC4568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x6794850: call_ber_oid_callback (packet-ber.c:538)
==21480==    by 0x6FBD8AC: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6FBD6EF: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==21480==    by 0x679713F: dissect_ber_sq_of (packet-ber.c:3486)
==21480==    by 0x679792D: dissect_ber_sequence_of (packet-ber.c:3517)
==21480==    by 0x6FBDEBF: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6EE983F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==  Address 0x1282af80 is 0 bytes inside a block of size 46 free'd
==21480==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==21480==    by 0x668C924: emem_free_all (emem.c:1187)
==21480==    by 0x668DA90: epan_dissect_run_with_taps (epan.c:350)
==21480==    by 0x4135C3: process_packet (tshark.c:3524)
==21480==    by 0x40C3E3: main (tshark.c:3312)
==21480== 
==21480== Invalid read of size 1
==21480==    at 0x9AC4FFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x9AC4568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x6794850: call_ber_oid_callback (packet-ber.c:538)
==21480==    by 0x6FBD8AC: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6FBD6EF: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==21480==    by 0x679713F: dissect_ber_sq_of (packet-ber.c:3486)
==21480==    by 0x679792D: dissect_ber_sequence_of (packet-ber.c:3517)
==21480==    by 0x6FBDEBF: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6EE983F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==  Address 0x1282af81 is 1 bytes inside a block of size 46 free'd
==21480==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==21480==    by 0x668C924: emem_free_all (emem.c:1187)
==21480==    by 0x668DA90: epan_dissect_run_with_taps (epan.c:350)
==21480==    by 0x4135C3: process_packet (tshark.c:3524)
==21480==    by 0x40C3E3: main (tshark.c:3312)
==21480== 
==21480== Invalid read of size 1
==21480==    at 0x9AC4FE0: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x9AC4568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x6698DBF: dissector_try_string (packet.c:1397)
==21480==    by 0x67948B8: call_ber_oid_callback (packet-ber.c:1104)
==21480==    by 0x6FBD8AC: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6FBD6EF: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==21480==    by 0x679713F: dissect_ber_sq_of (packet-ber.c:3486)
==21480==    by 0x679792D: dissect_ber_sequence_of (packet-ber.c:3517)
==21480==    by 0x6FBDEBF: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6EE983F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==21480==  Address 0x1282af80 is 0 bytes inside a block of size 46 free'd
==21480==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==21480==    by 0x668C924: emem_free_all (emem.c:1187)
==21480==    by 0x668DA90: epan_dissect_run_with_taps (epan.c:350)
==21480==    by 0x4135C3: process_packet (tshark.c:3524)
==21480==    by 0x40C3E3: main (tshark.c:3312)
==21480== 
==21480== Invalid read of size 1
==21480==    at 0x9AC4FFD: g_str_hash (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x9AC4568: g_hash_table_lookup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==21480==    by 0x6698DBF: dissector_try_string (packet.c:1397)
==21480==    by 0x67948B8: call_ber_oid_callback (packet-ber.c:1104)
==21480==    by 0x6FBD8AC: dissect_pkix1explicit_T_extnValue
(pkix1explicit.cnf:61)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6FBD6EF: dissect_pkix1explicit_Extension
(pkix1explicit.cnf:79)
==21480==    by 0x679713F: dissect_ber_sq_of (packet-ber.c:3486)
==21480==    by 0x679792D: dissect_ber_sequence_of (packet-ber.c:3517)
==21480==    by 0x6FBDEBF: dissect_pkix1explicit_Extensions
(pkix1explicit.cnf:92)
==21480==    by 0x67954FC: dissect_ber_sequence (packet-ber.c:2403)
==21480==    by 0x6EE983F: dissect_crmf_CertTemplate (packet-crmf-fn.c:43)
==21480==  Address 0x1282af81 is 1 bytes inside a block of size 46 free'd
==21480==    at 0x4C2BDEC: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==21480==    by 0x668C924: emem_free_all (emem.c:1187)
==21480==    by 0x668DA90: epan_dissect_run_with_taps (epan.c:350)
==21480==    by 0x4135C3: process_packet (tshark.c:3524)
==21480==    by 0x40C3E3: main (tshark.c:3312)
==21480== 
==21480== 
==21480== HEAP SUMMARY:
==21480==     in use at exit: 1,241,373 bytes in 29,657 blocks
==21480==   total heap usage: 405,552 allocs, 375,895 frees, 38,635,061 bytes
allocated
==21480== 
==21480== LEAK SUMMARY:
==21480==    definitely lost: 5,849 bytes in 194 blocks
==21480==    indirectly lost: 36,648 bytes in 49 blocks
==21480==      possibly lost: 0 bytes in 0 blocks
==21480==    still reachable: 1,198,876 bytes in 29,414 blocks
==21480==         suppressed: 0 bytes in 0 blocks
==21480== Rerun with --leak-check=full to see details of leaked memory
==21480== 
==21480== For counts of detected and suppressed errors, rerun with: -v
==21480== ERROR SUMMARY: 94 errors from 4 contexts (suppressed: 0 from 0)

[ no debug trace ]

You are receiving this mail because:

You are watching all bug changes.

Follow-Ups:
- [Wireshark-bugs] [Bug 10655] Buildbot crash output: fuzz-2014-10-31-21006.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 10655] Buildbot crash output: fuzz-2014-10-31-21006.pcap
  - From: bugzilla-daemon

Prev by Date: [Wireshark-bugs] [Bug 10651] TShark crashes when running with PDML on a specific packet
Next by Date: [Wireshark-bugs] [Bug 10641] WCCP v.2.01 extended assignment data element parsed wrong
Previous by thread: [Wireshark-bugs] [Bug 10611] Malformed PTPoE announce packet
Next by thread: [Wireshark-bugs] [Bug 10655] Buildbot crash output: fuzz-2014-10-31-21006.pcap
Index(es):
- Date
- Thread