Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11876] New: Buildbot crash output: fuzz-2015-12-10-18690.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11876
Summary	Buildbot crash output: fuzz-2015-12-10-18690.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2015-12-10-18690.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-12-10-18690.pcap

stderr:
Input file:
/home/wireshark/menagerie/menagerie/3873-wpa2-aes_pass_63_cant_decode_fil.pcap

Build host information:
Linux wsbb04 3.13.0-71-generic #114-Ubuntu SMP Tue Dec 1 02:34:22 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.3 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3440
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=a33209d69e95d025466f4efaebe22f6ae686c214

Return value:  0

Dissector bug:  0

Valgrind error count:  8



Git commit
commit a33209d69e95d025466f4efaebe22f6ae686c214
Author: Michael Mann <mmann78@netscape.net>
Date:   Wed Dec 9 21:50:10 2015 -0500

    Convert ASN.1 dissectors to remove "new" from "new-style" dissector
function names that were generated from asn2wrs.py

    This includes:
    1. new_create_dissector_handle -> create_dissector_handle
    2. new_register_dissector -> register_dissector
    3. new_register_ber_oid_dissector -> register_ber_oid_dissector
    4. new_register_ber_syntax_dissector -> register_ber_syntax_dissector

    Also remove PDU_NEW, SYNTAX_NEW and REGISTER_NEW as there is no need for
the distinction anymore.

    Change-Id: I82c7de7c8ffeeab3259d1b55bb4afc5f6a1e0329
    Reviewed-on: https://code.wireshark.org/review/12491
    Petri-Dish: Michael Mann <mmann78@netscape.net>
    Reviewed-by: Stig Bjørlykke <stig@bjorlykke.org>
    Reviewed-by: Michael Mann <mmann78@netscape.net>


Command and args: ./tools/valgrind-wireshark.sh -T

==2476== Memcheck, a memory error detector
==2476== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==2476== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==2476== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-Vx -nr
/fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-12-10-18690.pcap
==2476== 
Duplicative protocol PPP BCP in ppp.protocol
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF9188: dissect_wlan_radio (packet-ieee80211-radio.c:740)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF91AB: dissect_wlan_radio (packet-ieee80211-radio.c:745)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF91CD: dissect_wlan_radio (packet-ieee80211-radio.c:750)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF91F4: dissect_wlan_radio (packet-ieee80211-radio.c:755)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF921E: dissect_wlan_radio (packet-ieee80211-radio.c:760)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF9249: dissect_wlan_radio (packet-ieee80211-radio.c:765)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF9274: dissect_wlan_radio (packet-ieee80211-radio.c:770)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== Conditional jump or move depends on uninitialised value(s)
==2476==    at 0x6BF929A: dissect_wlan_radio (packet-ieee80211-radio.c:784)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x6E216E2: dissect_ppi (packet-ppi.c:1133)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682FECE: dissector_try_uint_new (packet.c:1148)
==2476==    by 0x6B2625F: dissect_frame (packet-frame.c:500)
==2476==    by 0x6830024: call_dissector_through_handle (packet.c:616)
==2476==    by 0x6830024: call_dissector_work (packet.c:691)
==2476==    by 0x682F55C: call_dissector_only (packet.c:2662)
==2476==    by 0x682F55C: call_dissector_with_data (packet.c:2675)
==2476==    by 0x682F435: dissect_record (packet.c:501)
==2476==    by 0x6823A9E: epan_dissect_run_with_taps (epan.c:373)
==2476==    by 0x413AF4: process_packet (tshark.c:3728)
==2476== 
==2476== 
==2476== HEAP SUMMARY:
==2476==     in use at exit: 1,041,067 bytes in 28,311 blocks
==2476==   total heap usage: 865,109 allocs, 836,798 frees, 77,227,884 bytes
allocated
==2476== 
==2476== LEAK SUMMARY:
==2476==    definitely lost: 2,908 bytes in 125 blocks
==2476==    indirectly lost: 36,448 bytes in 48 blocks
==2476==      possibly lost: 0 bytes in 0 blocks
==2476==    still reachable: 1,001,711 bytes in 28,138 blocks
==2476==         suppressed: 0 bytes in 0 blocks
==2476== Rerun with --leak-check=full to see details of leaked memory
==2476== 
==2476== For counts of detected and suppressed errors, rerun with: -v
==2476== Use --track-origins=yes to see where uninitialised values come from
==2476== ERROR SUMMARY: 8 errors from 8 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.