Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11231] New: Buildbot crash output: fuzz-2015-05-26-1567.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11231
Summary	Buildbot crash output: fuzz-2015-05-26-1567.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2015-05-26-1567.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-05-26-1567.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/hejja_msnms

Build host information:
Linux wsbb04 3.13.0-52-generic #86-Ubuntu SMP Mon May 4 04:32:59 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.2 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3233
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=7410afb64e9508b85a1252e170dafd3ecead5b6d

Return value:  0

Dissector bug:  0

Valgrind error count:  2



Git commit
commit 7410afb64e9508b85a1252e170dafd3ecead5b6d
Author: Stephane Bryant <stephane.ml.bryant@gmail.com>
Date:   Tue May 12 17:13:31 2015 +0200

    reload-framing: add range checks before bit-shifts

    Change-Id: I1422b581157ffa389f121306de4dc9241ffb4061
    Reviewed-on: https://code.wireshark.org/review/7595
    Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
    Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
    Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
    Reviewed-by: Anders Broman <a.broman58@gmail.com>


Command and args: ./tools/valgrind-wireshark.sh 

==32449== Memcheck, a memory error detector
==32449== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==32449== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==32449== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-05-26-1567.pcap
==32449== 
==32449== Invalid read of size 1
==32449==    at 0xB590C6A: inflate (in /lib/x86_64-linux-gnu/libz.so.1.2.8)
==32449==    by 0x678A9F1: tvb_uncompress (tvbuff_zlib.c:111)
==32449==    by 0x678AE12: tvb_child_uncompress (tvbuff_zlib.c:335)
==32449==    by 0x6AF37B0: dissect_http_message (packet-http.c:1370)
==32449==    by 0x6AF09A2: dissect_http (packet-http.c:2935)
==32449==    by 0x675A25F: call_dissector_work (packet.c:612)
==32449==    by 0x675A0FE: dissector_try_uint_new (packet.c:1132)
==32449==    by 0x6EAFDF3: decode_tcp_ports (packet-tcp.c:4129)
==32449==    by 0x6EB0E59: process_tcp_payload (packet-tcp.c:4187)
==32449==    by 0x6EB03AE: dissect_tcp_payload (packet-tcp.c:1997)
==32449==    by 0x6EB3EB0: dissect_tcp (packet-tcp.c:5075)
==32449==    by 0x675A27D: call_dissector_work (packet.c:614)
==32449==  Address 0x13e9bbba is 0 bytes after a block of size 10 alloc'd
==32449==    at 0x4C2AB80: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==32449==    by 0x9FE7610: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==32449==    by 0x678BD7E: tvb_memdup (tvbuff.c:829)
==32449==    by 0x678A863: tvb_uncompress (tvbuff_zlib.c:70)
==32449==    by 0x678AE12: tvb_child_uncompress (tvbuff_zlib.c:335)
==32449==    by 0x6AF37B0: dissect_http_message (packet-http.c:1370)
==32449==    by 0x6AF09A2: dissect_http (packet-http.c:2935)
==32449==    by 0x675A25F: call_dissector_work (packet.c:612)
==32449==    by 0x675A0FE: dissector_try_uint_new (packet.c:1132)
==32449==    by 0x6EAFDF3: decode_tcp_ports (packet-tcp.c:4129)
==32449==    by 0x6EB0E59: process_tcp_payload (packet-tcp.c:4187)
==32449==    by 0x6EB03AE: dissect_tcp_payload (packet-tcp.c:1997)
==32449== 
==32449== Invalid read of size 1
==32449==    at 0xB590C94: inflate (in /lib/x86_64-linux-gnu/libz.so.1.2.8)
==32449==    by 0x678A9F1: tvb_uncompress (tvbuff_zlib.c:111)
==32449==    by 0x678AE12: tvb_child_uncompress (tvbuff_zlib.c:335)
==32449==    by 0x6AF37B0: dissect_http_message (packet-http.c:1370)
==32449==    by 0x6AF09A2: dissect_http (packet-http.c:2935)
==32449==    by 0x675A25F: call_dissector_work (packet.c:612)
==32449==    by 0x675A0FE: dissector_try_uint_new (packet.c:1132)
==32449==    by 0x6EAFDF3: decode_tcp_ports (packet-tcp.c:4129)
==32449==    by 0x6EB0E59: process_tcp_payload (packet-tcp.c:4187)
==32449==    by 0x6EB03AE: dissect_tcp_payload (packet-tcp.c:1997)
==32449==    by 0x6EB3EB0: dissect_tcp (packet-tcp.c:5075)
==32449==    by 0x675A27D: call_dissector_work (packet.c:614)
==32449==  Address 0x13e9bbbb is 1 bytes after a block of size 10 alloc'd
==32449==    at 0x4C2AB80: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==32449==    by 0x9FE7610: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==32449==    by 0x678BD7E: tvb_memdup (tvbuff.c:829)
==32449==    by 0x678A863: tvb_uncompress (tvbuff_zlib.c:70)
==32449==    by 0x678AE12: tvb_child_uncompress (tvbuff_zlib.c:335)
==32449==    by 0x6AF37B0: dissect_http_message (packet-http.c:1370)
==32449==    by 0x6AF09A2: dissect_http (packet-http.c:2935)
==32449==    by 0x675A25F: call_dissector_work (packet.c:612)
==32449==    by 0x675A0FE: dissector_try_uint_new (packet.c:1132)
==32449==    by 0x6EAFDF3: decode_tcp_ports (packet-tcp.c:4129)
==32449==    by 0x6EB0E59: process_tcp_payload (packet-tcp.c:4187)
==32449==    by 0x6EB03AE: dissect_tcp_payload (packet-tcp.c:1997)
==32449== 
==32449== 
==32449== HEAP SUMMARY:
==32449==     in use at exit: 1,262,205 bytes in 30,126 blocks
==32449==   total heap usage: 539,729 allocs, 509,603 frees, 50,779,546 bytes
allocated
==32449== 
==32449== LEAK SUMMARY:
==32449==    definitely lost: 3,920 bytes in 176 blocks
==32449==    indirectly lost: 37,688 bytes in 76 blocks
==32449==      possibly lost: 0 bytes in 0 blocks
==32449==    still reachable: 1,220,597 bytes in 29,874 blocks
==32449==         suppressed: 0 bytes in 0 blocks
==32449== Rerun with --leak-check=full to see details of leaked memory
==32449== 
==32449== For counts of detected and suppressed errors, rerun with: -v
==32449== ERROR SUMMARY: 2 errors from 2 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.