Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 13100] New: Buildbot crash output: fuzz-2016-11-06-14396.pcap

Wireshark-bugs: [Wireshark-bugs] [Bug 13100] New: Buildbot crash output: fuzz-2016-11-06-14396.p

Date: Sun, 06 Nov 2016 18:40:03 +0000

Bug ID	13100
Summary	Buildbot crash output: fuzz-2016-11-06-14396.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2016-11-06-14396.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2016-11-06-14396.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/14032-sample_cid1_gen19.pcap

Build host information:
Linux wsbb04 4.4.0-45-generic #66-Ubuntu SMP Wed Oct 19 14:12:37 UTC 2016
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 16.04.1 LTS
Release:    16.04
Codename:    xenial

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_WORKERNAME=clang-code-analysis
BUILDBOT_BUILDNUMBER=3771
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_GOT_REVISION=dcd0bed7a97edc2f19a63bdf9b7ff6dcb37cd96b

Return value:  0

Dissector bug:  0

Valgrind error count:  5



Git commit
commit dcd0bed7a97edc2f19a63bdf9b7ff6dcb37cd96b
Author: Alexis La Goutte <alexis.lagoutte@gmail.com>
Date:   Thu Nov 3 08:49:10 2016 +0100

    USB Audio: Fix dissection of unit descriptors missing the iFeature field

    Issue reported by Vladimir Vysotsky

    Bug: 13085
    Change-Id: Ibdc1bf662f852818777cfb44fa19d798972390ca
    Reviewed-on: https://code.wireshark.org/review/18651
    Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
    Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
    Reviewed-by: Michael Mann <mmann78@netscape.net>


==29979== Memcheck, a memory error detector
==29979== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==29979== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==29979== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2016-11-06-14396.pcap
==29979== 
==29979== Invalid read of size 1
==29979==    at 0x69DAD1B: fragment_add_seq_single_work (reassemble.c:2235)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AEF0C: call_dissector_only (packet.c:2954)
==29979==    by 0x69AEF0C: call_dissector_with_data (packet.c:2967)
==29979==  Address 0x13affd05 is 37 bytes inside a block of size 56 free'd
==29979==    at 0x4C2EDEB: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0x69D95CA: fragment_delete (reassemble.c:606)
==29979==    by 0x69DAC8D: fragment_add_seq_single_work (reassemble.c:2216)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==  Block was alloc'd at
==29979==    at 0x4C2DB8F: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0xA6EB728: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702932: g_slice_alloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702FCD: g_slice_alloc0 (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0x69DAD65: new_head (reassemble.c:366)
==29979==    by 0x69DAD65: fragment_add_seq_single_work (reassemble.c:2274)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979== 
==29979== Invalid read of size 4
==29979==    at 0x69DAD22: fragment_add_seq_single_work (reassemble.c:2238)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AEF0C: call_dissector_only (packet.c:2954)
==29979==    by 0x69AEF0C: call_dissector_with_data (packet.c:2967)
==29979==  Address 0x13affcf8 is 24 bytes inside a block of size 56 free'd
==29979==    at 0x4C2EDEB: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0x69D95CA: fragment_delete (reassemble.c:606)
==29979==    by 0x69DAC8D: fragment_add_seq_single_work (reassemble.c:2216)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==  Block was alloc'd at
==29979==    at 0x4C2DB8F: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0xA6EB728: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702932: g_slice_alloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702FCD: g_slice_alloc0 (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0x69DAD65: new_head (reassemble.c:366)
==29979==    by 0x69DAD65: fragment_add_seq_single_work (reassemble.c:2274)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979== 
==29979== Invalid read of size 1
==29979==    at 0x69DB0E4: fragment_add_seq_single_work (reassemble.c:2239)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AEF0C: call_dissector_only (packet.c:2954)
==29979==    by 0x69AEF0C: call_dissector_with_data (packet.c:2967)
==29979==  Address 0x13affd05 is 37 bytes inside a block of size 56 free'd
==29979==    at 0x4C2EDEB: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0x69D95CA: fragment_delete (reassemble.c:606)
==29979==    by 0x69DAC8D: fragment_add_seq_single_work (reassemble.c:2216)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==  Block was alloc'd at
==29979==    at 0x4C2DB8F: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0xA6EB728: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702932: g_slice_alloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702FCD: g_slice_alloc0 (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0x69DAD65: new_head (reassemble.c:366)
==29979==    by 0x69DAD65: fragment_add_seq_single_work (reassemble.c:2274)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979== 
==29979== Invalid write of size 4
==29979==    at 0x69DB0E9: fragment_add_seq_single_work (reassemble.c:2240)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AEF0C: call_dissector_only (packet.c:2954)
==29979==    by 0x69AEF0C: call_dissector_with_data (packet.c:2967)
==29979==  Address 0x13affcf8 is 24 bytes inside a block of size 56 free'd
==29979==    at 0x4C2EDEB: free (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0x69D95CA: fragment_delete (reassemble.c:606)
==29979==    by 0x69DAC8D: fragment_add_seq_single_work (reassemble.c:2216)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFD1E: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x6CC959E: dissect_frame (packet-frame.c:507)
==29979==  Block was alloc'd at
==29979==    at 0x4C2DB8F: malloc (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==29979==    by 0xA6EB728: g_malloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702932: g_slice_alloc (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0xA702FCD: g_slice_alloc0 (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==29979==    by 0x69DAD65: new_head (reassemble.c:366)
==29979==    by 0x69DAD65: fragment_add_seq_single_work (reassemble.c:2274)
==29979==    by 0x69DB13D: fragment_add_seq_single_aging (reassemble.c:2401)
==29979==    by 0x6FEEFD1: dissect_mp (packet-ppp.c:5322)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979==    by 0x69AFF39: dissector_try_uint_new (packet.c:1290)
==29979==    by 0x69AFF39: dissector_try_uint (packet.c:1316)
==29979==    by 0x6FF1FE8: dissect_ppp_common (packet-ppp.c:4366)
==29979==    by 0x6FEEA8C: dissect_ppp_hdlc (packet-ppp.c:5445)
==29979==    by 0x69AFE55: call_dissector_through_handle (packet.c:650)
==29979==    by 0x69AFE55: call_dissector_work (packet.c:725)
==29979== 
==29979== 
==29979== HEAP SUMMARY:
==29979==     in use at exit: 6,085,641 bytes in 9,725 blocks
==29979==   total heap usage: 308,841 allocs, 299,116 frees, 39,454,626 bytes
allocated
==29979== 
==29979== LEAK SUMMARY:
==29979==    definitely lost: 344 bytes in 86 blocks
==29979==    indirectly lost: 0 bytes in 0 blocks
==29979==      possibly lost: 0 bytes in 0 blocks
==29979==    still reachable: 6,085,297 bytes in 9,639 blocks
==29979==         suppressed: 0 bytes in 0 blocks
==29979== Rerun with --leak-check=full to see details of leaked memory
==29979== 
==29979== For counts of detected and suppressed errors, rerun with: -v
==29979== ERROR SUMMARY: 5 errors from 4 contexts (suppressed: 0 from 0)

[ no debug trace ]

You are receiving this mail because:

You are watching all bug changes.

Follow-Ups:
- [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
  - From: bugzilla-daemon
- [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
  - From: bugzilla-daemon

Prev by Date: [Wireshark-bugs] [Bug 13092] E212: 3 digits MNC are identified as 2 digits long if they end with a 0
Next by Date: [Wireshark-bugs] [Bug 13101] New: Buildbot crash output: fuzz-2016-11-06-27917.pcap
Previous by thread: [Wireshark-bugs] [Bug 12183] tshark with randpktdump reporting "pointer being freed was not allocated" on exit
Next by thread: [Wireshark-bugs] [Bug 13100] Buildbot crash output: fuzz-2016-11-06-14396.pcap
Index(es):
- Date
- Thread