Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11585] New: Buildbot crash output: fuzz-2015-10-10-13251.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11585
Summary	Buildbot crash output: fuzz-2015-10-10-13251.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2015-10-10-13251.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-10-10-13251.pcap

stderr:
Input file:
/home/wireshark/menagerie/menagerie/13690-tdls_decrypt_wireshark.pcap

Build host information:
Linux wsbb04 3.13.0-65-generic #105-Ubuntu SMP Mon Sep 21 18:50:58 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.3 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3334
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=2bd7c48b44af5ebedefdb4c98d1b8cb708463881

Return value:  0

Dissector bug:  0

Valgrind error count:  7



Git commit
commit 2bd7c48b44af5ebedefdb4c98d1b8cb708463881
Author: Guy Harris <guy@alum.mit.edu>
Date:   Thu Oct 8 13:43:08 2015 -0700

    The second argument to AC_PATH_PROGS is a list of program names.

    The *third* argument is the value to use if we don't find the program;
    we shouldn't fall back on "python3" if we can't find "python", we should
    try both "python" and "python3" and just set $PYTHON to nothing if we
    don't find either one.

    Change-Id: I5168455f09bc3165c49db4334f05856dec46bf62
    Reviewed-on: https://code.wireshark.org/review/10890
    Reviewed-by: Guy Harris <guy@alum.mit.edu>


Command and args: ./tools/valgrind-wireshark.sh 

==4817== Memcheck, a memory error detector
==4817== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==4817== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==4817== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-10-10-13251.pcap
==4817== 
==4817== Conditional jump or move depends on uninitialised value(s)
==4817==    at 0x684C8B5: AirPDcapDecryptWPABroadcastKey (airpdcap.c:415)
==4817==    by 0x684BB14: AirPDcapScanForKeys (airpdcap.c:1428)
==4817==    by 0x6BD8E3E: dissect_ieee80211_common (packet-ieee80211.c:17710)
==4817==    by 0x6BD47A5: dissect_ieee80211 (packet-ieee80211.c:18317)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x6BC393B: dissect_radiotap (packet-ieee80211-radiotap.c:1801)
==4817==    by 0x680169D: call_dissector_work (packet.c:620)
==4817==    by 0x680151E: dissector_try_uint_new (packet.c:1163)
==4817==    by 0x6AED77F: dissect_frame (packet-frame.c:499)
==4817== 
==4817== Conditional jump or move depends on uninitialised value(s)
==4817==    at 0x684C8A2: AirPDcapDecryptWPABroadcastKey (airpdcap.c:409)
==4817==    by 0x684BB14: AirPDcapScanForKeys (airpdcap.c:1428)
==4817==    by 0x6BD8E3E: dissect_ieee80211_common (packet-ieee80211.c:17710)
==4817==    by 0x6BD47A5: dissect_ieee80211 (packet-ieee80211.c:18317)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x6BC393B: dissect_radiotap (packet-ieee80211-radiotap.c:1801)
==4817==    by 0x680169D: call_dissector_work (packet.c:620)
==4817==    by 0x680151E: dissector_try_uint_new (packet.c:1163)
==4817==    by 0x6AED77F: dissect_frame (packet-frame.c:499)
==4817== 
==4817== Use of uninitialised value of size 8
==4817==    at 0x684C8A9: AirPDcapDecryptWPABroadcastKey (airpdcap.c:415)
==4817==    by 0x684BB14: AirPDcapScanForKeys (airpdcap.c:1428)
==4817==    by 0x6BD8E3E: dissect_ieee80211_common (packet-ieee80211.c:17710)
==4817==    by 0x6BD47A5: dissect_ieee80211 (packet-ieee80211.c:18317)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x6BC393B: dissect_radiotap (packet-ieee80211-radiotap.c:1801)
==4817==    by 0x680169D: call_dissector_work (packet.c:620)
==4817==    by 0x680151E: dissector_try_uint_new (packet.c:1163)
==4817==    by 0x6AED77F: dissect_frame (packet-frame.c:499)
==4817== 
==4817== Conditional jump or move depends on uninitialised value(s)
==4817==    at 0x684C8BC: AirPDcapDecryptWPABroadcastKey (airpdcap.c:416)
==4817==    by 0x684BB14: AirPDcapScanForKeys (airpdcap.c:1428)
==4817==    by 0x6BD8E3E: dissect_ieee80211_common (packet-ieee80211.c:17710)
==4817==    by 0x6BD47A5: dissect_ieee80211 (packet-ieee80211.c:18317)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x6BC393B: dissect_radiotap (packet-ieee80211-radiotap.c:1801)
==4817==    by 0x680169D: call_dissector_work (packet.c:620)
==4817==    by 0x680151E: dissector_try_uint_new (packet.c:1163)
==4817==    by 0x6AED77F: dissect_frame (packet-frame.c:499)
==4817== 
==4817== Use of uninitialised value of size 8
==4817==    at 0x684C88B: AirPDcapDecryptWPABroadcastKey (airpdcap.c:419)
==4817==    by 0x684BB14: AirPDcapScanForKeys (airpdcap.c:1428)
==4817==    by 0x6BD8E3E: dissect_ieee80211_common (packet-ieee80211.c:17710)
==4817==    by 0x6BD47A5: dissect_ieee80211 (packet-ieee80211.c:18317)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x680167F: call_dissector_work (packet.c:618)
==4817==    by 0x6800C3C: call_dissector_with_data (packet.c:2549)
==4817==    by 0x6BC393B: dissect_radiotap (packet-ieee80211-radiotap.c:1801)
==4817==    by 0x680169D: call_dissector_work (packet.c:620)
==4817==    by 0x680151E: dissector_try_uint_new (packet.c:1163)
==4817==    by 0x6AED77F: dissect_frame (packet-frame.c:499)
==4817== 
==4817== 
==4817== HEAP SUMMARY:
==4817==     in use at exit: 1,038,163 bytes in 28,221 blocks
==4817==   total heap usage: 442,946 allocs, 414,725 frees, 37,654,036 bytes
allocated
==4817== 
==4817== LEAK SUMMARY:
==4817==    definitely lost: 2,908 bytes in 125 blocks
==4817==    indirectly lost: 36,448 bytes in 48 blocks
==4817==      possibly lost: 0 bytes in 0 blocks
==4817==    still reachable: 998,807 bytes in 28,048 blocks
==4817==         suppressed: 0 bytes in 0 blocks
==4817== Rerun with --leak-check=full to see details of leaked memory
==4817== 
==4817== For counts of detected and suppressed errors, rerun with: -v
==4817== Use --track-origins=yes to see where uninitialised values come from
==4817== ERROR SUMMARY: 7 errors from 5 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.