Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11028] New: Buildbot crash output: fuzz-2015-03-05-14089.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11028
Summary	Buildbot crash output: fuzz-2015-03-05-14089.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2015-03-05-14089.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-03-05-14089.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/12695-AllJoynSample2.pcapng

Build host information:
Linux wsbb04 3.13.0-45-generic #74-Ubuntu SMP Tue Jan 13 19:36:28 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.2 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3171
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=763b6d325194a949a51bed7636caeaa7112b5ba3

Return value:  0

Dissector bug:  0

Valgrind error count:  3



Git commit
commit 763b6d325194a949a51bed7636caeaa7112b5ba3
Author: Pascal Quantin <pascal.quantin@gmail.com>
Date:   Mon Mar 2 22:51:38 2015 +0100

    Added JSMN_STRICT that allow a more precise json parsing.

    Bug: 10977
    Change-Id: I725c10d895fdec4530d0761db3ac2659171f2f03
    Reviewed-on: https://code.wireshark.org/review/7249
    Reviewed-by: Peter Wu <peter@lekensteyn.nl>
    Tested-by: Peter Wu <peter@lekensteyn.nl>


Command and args: ./tools/valgrind-wireshark.sh 

==13087== Memcheck, a memory error detector
==13087== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==13087== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==13087== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-03-05-14089.pcap
==13087== 
==13087== Invalid read of size 1
==13087==    at 0x67A5CBD: parse_arg (packet-alljoyn.c:1242)
==13087==    by 0x67A6921: dissect_AllJoyn_message (packet-alljoyn.c:1449)
==13087==    by 0x671B05E: call_dissector_through_handle (packet.c:612)
==13087==    by 0x671B9F4: call_dissector_work (packet.c:700)
==13087==    by 0x671C13B: dissector_try_uint_new (packet.c:1132)
==13087==    by 0x6E3F235: decode_tcp_ports (packet-tcp.c:4141)
==13087==    by 0x6E3F5EE: process_tcp_payload (packet-tcp.c:4199)
==13087==    by 0x6E3FBD5: dissect_tcp_payload (packet-tcp.c:1997)
==13087==    by 0x6E41853: dissect_tcp (packet-tcp.c:5087)
==13087==    by 0x671B023: call_dissector_through_handle (packet.c:614)
==13087==    by 0x671B9F4: call_dissector_work (packet.c:700)
==13087==    by 0x671C13B: dissector_try_uint_new (packet.c:1132)
==13087==  Address 0x12244573 is 0 bytes after a block of size 3 alloc'd
==13087==    at 0x4C2CE8E: realloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==13087==    by 0x9C3E6AE: g_realloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==13087==    by 0x726F410: wmem_simple_realloc (wmem_allocator_simple.c:90)
==13087==    by 0x72709CC: wmem_strbuf_finalize (wmem_strbuf.c:252)
==13087==    by 0x67A56E8: parse_arg (packet-alljoyn.c:1002)
==13087==    by 0x67A67B3: dissect_AllJoyn_message (packet-alljoyn.c:1350)
==13087==    by 0x671B05E: call_dissector_through_handle (packet.c:612)
==13087==    by 0x671B9F4: call_dissector_work (packet.c:700)
==13087==    by 0x671C13B: dissector_try_uint_new (packet.c:1132)
==13087==    by 0x6E3F235: decode_tcp_ports (packet-tcp.c:4141)
==13087==    by 0x6E3F5EE: process_tcp_payload (packet-tcp.c:4199)
==13087==    by 0x6E3FBD5: dissect_tcp_payload (packet-tcp.c:1997)
==13087== 
==13087== Invalid read of size 1
==13087==    at 0x67A5C97: parse_arg (packet-alljoyn.c:1243)
==13087==    by 0x67A6921: dissect_AllJoyn_message (packet-alljoyn.c:1449)
==13087==    by 0x671B05E: call_dissector_through_handle (packet.c:612)
==13087==    by 0x671B9F4: call_dissector_work (packet.c:700)
==13087==    by 0x671C13B: dissector_try_uint_new (packet.c:1132)
==13087==    by 0x6E3F235: decode_tcp_ports (packet-tcp.c:4141)
==13087==    by 0x6E3F5EE: process_tcp_payload (packet-tcp.c:4199)
==13087==    by 0x6E3FBD5: dissect_tcp_payload (packet-tcp.c:1997)
==13087==    by 0x6E41853: dissect_tcp (packet-tcp.c:5087)
==13087==    by 0x671B023: call_dissector_through_handle (packet.c:614)
==13087==    by 0x671B9F4: call_dissector_work (packet.c:700)
==13087==    by 0x671C13B: dissector_try_uint_new (packet.c:1132)
==13087==  Address 0x12244573 is 0 bytes after a block of size 3 alloc'd
==13087==    at 0x4C2CE8E: realloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==13087==    by 0x9C3E6AE: g_realloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==13087==    by 0x726F410: wmem_simple_realloc (wmem_allocator_simple.c:90)
==13087==    by 0x72709CC: wmem_strbuf_finalize (wmem_strbuf.c:252)
==13087==    by 0x67A56E8: parse_arg (packet-alljoyn.c:1002)
==13087==    by 0x67A67B3: dissect_AllJoyn_message (packet-alljoyn.c:1350)
==13087==    by 0x671B05E: call_dissector_through_handle (packet.c:612)
==13087==    by 0x671B9F4: call_dissector_work (packet.c:700)
==13087==    by 0x671C13B: dissector_try_uint_new (packet.c:1132)
==13087==    by 0x6E3F235: decode_tcp_ports (packet-tcp.c:4141)
==13087==    by 0x6E3F5EE: process_tcp_payload (packet-tcp.c:4199)
==13087==    by 0x6E3FBD5: dissect_tcp_payload (packet-tcp.c:1997)
==13087== 
==13087== 
==13087== HEAP SUMMARY:
==13087==     in use at exit: 1,227,715 bytes in 29,820 blocks
==13087==   total heap usage: 243,892 allocs, 214,072 frees, 30,998,290 bytes
allocated
==13087== 
==13087== LEAK SUMMARY:
==13087==    definitely lost: 3,320 bytes in 142 blocks
==13087==    indirectly lost: 36,968 bytes in 51 blocks
==13087==      possibly lost: 0 bytes in 0 blocks
==13087==    still reachable: 1,187,427 bytes in 29,627 blocks
==13087==         suppressed: 0 bytes in 0 blocks
==13087== Rerun with --leak-check=full to see details of leaked memory
==13087== 
==13087== For counts of detected and suppressed errors, rerun with: -v
==13087== ERROR SUMMARY: 3 errors from 2 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.