Wireshark · Wireshark-dev: [Wireshark-dev] SVN revision 36849 crashing in packet_range_init function

[Pascal Quantin <pascal.quantin@xxxxxxxxx>]

Hi,

with revision 36849, when I call tshark to decode in verbose mode a pcap file containing a single packet I get the following backtrace:

tshark -r temp.pcap -V

Program received signal SIGSEGV, Segmentation fault.

[Switching to Thread 0xb571c8e0 (LWP 11951)]
packet_range_init (range=0xbfd9f550) at packet-range.c:88
88          if (packet->flags.passed_dfilter) {
(gdb) bt
#0  packet_range_init (range=0xbfd9f550) at packet-range.c:88

#1  0x0806bac6 in print_packet (cf=0x80a5d40, edt=0xbfd9f5f8) at tshark.c:3239
#2  0x0806c395 in process_packet (cf=0x80a5d40, offset=<value optimized out>, whdr=0x9125f40, pseudo_header=0x9125f54, pd=0x912b730 "h\022\230\b��\001\203��s?E��+\230!Ll�", 

    filtering_tap_listeners=0, tap_flags=<value optimized out>) at tshark.c:2905
#3  0x0806f4ea in main (argc=4, argv=0xbfd9fc84) at tshark.c:2705

When launching tshark without the verbose flag, the crash is not seen.

When looking at the revision log, I can see that the code was changed from:

for(packet = cfile.plist_start; packet != NULL; packet = packet->next) {

to

for(framenum = 1; framenum <= cfile.count; framenum++) {

    packet = cap_file_find_fdata(&cfile, framenum);

In my use case, packet is set to NULL, leading to the segmentation fault.

When looking at tshark.c source code, I can see that process_packet() does not call cap_file_add_fdata() while process_packet_first_pass() does. As a consequence the cf->ptree_root pointer is not allocated and the call to cap_file_find_fdata() will provide an uninitialized address.

The following patch solves my crash:

Index: tshark.c
===================================================================
--- tshark.c    (revision 36849)
+++ tshark.c    (working copy)
@@ -2830,9 +2830,6 @@

   epan_dissect_t edt;
   gboolean passed;
 
-  /* Count this packet. */
-  cf->count++;
-
   /* If we're not running a display filter and we're not printing any
      packet information, we don't need to do a dissection. This means

      that all packets can be marked as 'passed'. */
@@ -2896,6 +2893,7 @@
 
   if (passed) {
     frame_data_set_after_dissect(&fdata, &cum_bytes, &prev_dis_ts);
+    cap_file_add_fdata(cf, &fdata);

 
     /* Process this packet. */
     if (print_packet_info) {

But I'm not sure this is the right way to fix this. Can someone comment ?

Thanks,
Pascal.