[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

--- Comment #9 from Gerrit Code Review  ---
Change 30449 had a related patch set uploaded by Pascal Quantin:
wsutil: introduce ws_pipe_close() helper and use it to terminate mmdbresolve

https://code.wireshark.org/review/30449

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15253] SEP_* does not work as expected for FT_BYTES

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15253

--- Comment #2 from Gerrit Code Review  ---
Change 30447 had a related patch set uploaded by Jeremy Martin:
FT_BYTES: fix dissection of FT_BYTES when using SEP_SPACE and "NONE" options

https://code.wireshark.org/review/30447

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

Pascal Quantin  changed:

   What|Removed |Added

 Status|CONFIRMED   |IN_PROGRESS

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15253] SEP_* does not work as expected for FT_BYTES

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15253

boardermar...@gmail.com changed:

   What|Removed |Added

Summary|SEP_* do not work as|SEP_* does not work as
   |expected for FT_BYTES   |expected for FT_BYTES

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15253] SEP_* do not work as expected for FT_BYTES

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15253

boardermar...@gmail.com changed:

   What|Removed |Added

 CC||boardermar...@gmail.com,
   ||pascal.quan...@gmail.com,
   ||realrichardsha...@gmail.com

--- Comment #1 from boardermar...@gmail.com ---
TShark (Wireshark) 2.9.0 (v2.9.0rc0-2377-ge655b9ac)

Copyright 1998-2018 Gerald Combs  and contributors.
License GPLv2+: GNU GPL version 2 or later

This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, without POSIX capabilities, without libnl, with
GLib 2.48.2, with zlib 1.2.8, without SMI, without c-ares, without Lua, without
GnuTLS, with Gcrypt 1.6.5, without Kerberos, without MaxMind DB resolver,
without nghttp2, without LZ4, without Snappy, without libxml2.

Running on Linux 4.15.0-36-generic, with Intel(R) Core(TM) i7-7920HQ CPU @
3.10GHz (with SSE4.2), with 64268 MB of physical memory, with locale
en_US.UTF-8, with libpcap version 1.7.4, with Gcrypt 1.6.5, with zlib 1.2.8,
binary plugins supported (13 loaded).

Built using gcc 5.4.0 20160609.


FT_BYTES separator functionality does not work as expected. Examples  
- SEP_SPACE does not work 
- BASE_NONE does nothing as it is set to colon (:) by default

Fixed SEP_SPACE and added SEP_NONE to do what BASE_NONE would be expected to do
without causing issues with current use of BASE_NONE.

Submitting code patch to gerrit.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15253] New: SEP_* do not work as expected for FT_BYTES

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15253

Bug ID: 15253
   Summary: SEP_* do not work as expected for FT_BYTES
   Product: Wireshark
   Version: Git
  Hardware: All
OS: Linux
Status: UNCONFIRMED
  Severity: Normal
  Priority: Low
 Component: Dissection engine (libwireshark)
  Assignee: bugzilla-ad...@wireshark.org
  Reporter: boardermar...@gmail.com
  Target Milestone: ---

Build Information:
Paste the COMPLETE build information from "Help->About Wireshark", "wireshark
-v", or "tshark -v".
--

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

--- Comment #8 from Pascal Quantin  ---
On Windows, we need to call TerminateProcess instead of g_spawn_close_pid(). I
will upload a patch shortly.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

--- Comment #7 from Pascal Quantin  ---
It seems like g_spawn_close_pid() does not kill mmdbresolve.exe process as long
as there is another mmdbresolve.exe process still running.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

--- Comment #6 from Landi  ---
I did also reproduce it with the 32-bit
WiresharkPortable_2.9.0-2376-gd3f213c2.paf on Windows 10 64-bit

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15229] Tshark memory leak (continuous live capture)

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15229

Peter Wu  changed:

   What|Removed |Added

Summary|Tshark memory leak  |Tshark memory leak
   ||(continuous live capture)
 Status|UNCONFIRMED |CONFIRMED
 Ever confirmed|0   |1
 CC||pe...@lekensteyn.nl

--- Comment #2 from Peter Wu  ---
Hi Sergiy,

Unfortunately this is not a memory leak but a limitation of the current
dissection engine. Dissection of a single packet can result in retaining
persistent conversation information until the packet capture file is closed.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14659] NTP Analysis: Delta time between Client-Server

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14659

--- Comment #9 from Johannes Weber  ---
Hey Pascal,

wow, thanks a lot for that!!

Johannes

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

Peter Wu  changed:

   What|Removed |Added

 CC||dato...@gmail.com

--- Comment #5 from Peter Wu  ---
*** Bug 15122 has been marked as a duplicate of this bug. ***

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15122] tshark.exe usage creates orphaned mmdbresolve.exe processes

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15122

Peter Wu  changed:

   What|Removed |Added

 Status|UNCONFIRMED |RESOLVED
 Resolution|--- |DUPLICATE

--- Comment #4 from Peter Wu  ---
Bug 15248 seems to describe the exact same issue but contains more details, so
I'm marking this as duplicate. The steps in comment 1 should have omitted step
5 (to keep Wireshark open).

*** This bug has been marked as a duplicate of bug 15248 ***

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

--- Comment #4 from Peter Wu  ---
I can also reproduce it without Wireshark and two tshark processes only:

1. Keep a tshark process open with a mmdbresolve.exe process.
tshark -Xlua_script:sleep.lua -r dns+icmp.pcapng.gz
local proto = Proto.new("dummysleep", "sleeping")
function proto.dissector()
print("Sleep")
local t2 = os.clock() + 10
while (os.clock() < t2) do
end
print("Awake")
end
register_postdissector(proto)

2. Run another "tshark -r dns+icmp.pcapng.gz | sort" pipe

"sort" is not necessary, without it you can still observe stray mmdbresolve.exe
processes.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14659] NTP Analysis: Delta time between Client-Server

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14659

Pascal Quantin  changed:

   What|Removed |Added

 Resolution|--- |FIXED
 Status|IN_PROGRESS |RESOLVED

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14659] NTP Analysis: Delta time between Client-Server

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14659

--- Comment #8 from Gerrit Code Review  ---
Change 30442 merged by Pascal Quantin:
NTP: add request/response tracking to client, server and control packets

https://code.wireshark.org/review/30442

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

--- Comment #3 from Peter Wu  ---
I can still reproduce the issue with Wireshark-win64-2.9.0-2376-gd3f213c2.exe

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

Pascal Quantin  changed:

   What|Removed |Added

 CC||pascal.quan...@gmail.com

--- Comment #2 from Pascal Quantin  ---
Landi,

could you give a try to a Wireshark 2.9.0 development build
(https://www.wireshark.org/download/automated/win64/)?
In the context of bug 14701 there have been some changes done in this area that
were not backported to master-2.6 branch.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15156] packet-bthci.c incorrectly parses allowed SCO packet bitfield for synchronous request commands/reponses

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15156

Michał Łabędzki  changed:

   What|Removed |Added

   Assignee|bugzilla-ad...@wireshark.or |michal.labedzki@wireshark.o
   |g   |rg
 Status|INCOMPLETE  |IN_PROGRESS

--- Comment #3 from Michał Łabędzki  ---
I already finish the investigation and... all bits meaning is wrong right now.
I am preparing the patch that fixes that.

Bluetooth specification does not exactly says if the packet type is allowed or
not. It likes to use "may be used", "may NOT be used" or "shall NOT be used". I
will follow the specification style.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15252] New: Support for pcapng DSB (Decryption Secrets Block) to enable embedding TLS key log secrets

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15252

Bug ID: 15252
   Summary: Support for pcapng DSB (Decryption Secrets Block) to
enable embedding TLS key log secrets
   Product: Wireshark
   Version: Git
  Hardware: All
OS: All
Status: IN_PROGRESS
  Severity: Enhancement
  Priority: Low
 Component: Capture file support (libwiretap)
  Assignee: bugzilla-ad...@wireshark.org
  Reporter: pe...@lekensteyn.nl
CC: alexis.lagou...@gmail.com, anders.bro...@ericsson.com,
jas...@packet-foo.com, realrichardsha...@gmail.com,
s...@bjorlykke.org
  Target Milestone: ---

Build Information:
v2.9.0rc0-2375-gc672124881
--
Use case:
Store TLS decryption secrets in a pcapng file to avoid the need for extra
out-of-band configuration of Wireshark. Bug 9616 implemented this through a
packet capture comment, but using pcapng blocks for this is preferable.

pcapng specification update: https://github.com/pcapng/pcapng/pull/54
This bug tracks the implementation in Wireshark and starts with the (D)TLS
dissector as the initial user of this feature.

New protocols (802.11 or ZigBee?) could be implemented in the future but needs:
- A pcapng Secrets Type assignment.
- A secrets format definition.
- A capture file with the corresponding secrets.

Required changes:
- libwiretap: parse and read the new SDB.
- libwireshark: load the SDB secrets to enable (D)TLS decryption.
- libwiretap or Qt: warn when trying to save a pcapng+SDB file in some other
format that does not support SDBs.
- Qt: options to strip secrets while saving a file.
- Documentation: document supported secrets, clarify risks of embedding
secrets.
- Create/Update a tool to retroactively insert a SDB for an existing file.
- Tests: include a pcapng file with a TLS SDB.

Wishlist:
- libwiretap/libwireshark: Import secrets from an external keylog file into the
SDB. This requires tracking which secrets are actually used within a session
based on the Client Hello.
- Export Specified Packets: reduce the exported secrets to those which are
actually included in the exported packets.

The initial wiretap *read-only* support patch (WIP):
https://code.wireshark.org/review/29901

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 9616] use capture file comment to configure SSL dissector

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9616

Peter Wu  changed:

   What|Removed |Added

   See Also||https://bugs.wireshark.org/
   ||bugzilla/show_bug.cgi?id=15
   ||252

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15230] tshark 2.6 does not print geoIP information

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15230

Peter Wu  changed:

   What|Removed |Added

 Status|CONFIRMED   |IN_PROGRESS

--- Comment #6 from Peter Wu  ---
The issue was already fixed downstream in
https://salsa.debian.org/debian/wireshark/commit/bc93d9c4de

Versions 2.6.3-1~ubuntu18.04.1 and 2.6.4-1 are still affected. Balint, could
you close this bug once updated versions have been released?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14659] NTP Analysis: Delta time between Client-Server

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14659

--- Comment #7 from Gerrit Code Review  ---
Change 30442 had a related patch set uploaded by Pascal Quantin:
NTP: add request/response tracking to client, server anc control packets

https://code.wireshark.org/review/30442

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15230] tshark 2.6 does not print geoIP information

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15230

--- Comment #5 from Gerrit Code Review  ---
Change 30441 merged by Peter Wu:
debian: install required GeoIP resolver executable and manual page

https://code.wireshark.org/review/30441

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15230] tshark 2.6 does not print geoIP information

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15230

--- Comment #4 from Gerrit Code Review  ---
Change 30441 had a related patch set uploaded by Peter Wu:
debian: install required GeoIP resolver executable and manual page

https://code.wireshark.org/review/30441

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15230] tshark 2.6 does not print geoIP information

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15230

--- Comment #3 from Gerrit Code Review  ---
Change 30439 merged by Anders Broman:
debian: install required GeoIP resolver executable and manual page

https://code.wireshark.org/review/30439

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15251] [oss-fuzz] UBSAN: null pointer passed as argument 2, which is declared to never be null in packet-iax2.c:721:35

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15251

--- Comment #2 from Peter Wu  ---
The oss-fuzz warning was about a different issue (undefined shift) and can be
reproduced with the original file:

tail -c 20
clusterfuzz-testcase-minimized-fuzzshark_ip_proto-udp-5680214932193280.pcap >
clusterfuzz-testcase-minimized-fuzzshark_ip_proto-udp-5680214932193280 &&
HOME=/x FUZZSHARK_TARGET=udp fuzzshark
clusterfuzz-testcase-minimized-fuzzshark_ip_proto-udp-5680214932193280

epan/dissectors/packet-iax2.c:721:35: runtime error: null pointer passed as
argument 2, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
#0 0x7fba27a8b96e in iax_circuit_lookup epan/dissectors/packet-iax2.c:721:5
#1 0x7fba27a86851 in iax_lookup_call epan/dissectors/packet-iax2.c:973:20
#2 0x7fba27a8064b in dissect_fullpacket
epan/dissectors/packet-iax2.c:1790:18
#3 0x7fba27a7fbb4 in dissect_iax2 epan/dissectors/packet-iax2.c:1232:13
#4 0x7fba2aa2f685 in call_dissector_through_handle epan/packet.c:706:9
#5 0x7fba2aa1a388 in call_dissector_work epan/packet.c:791:9
#6 0x7fba2aa19428 in dissector_try_uint_new epan/packet.c:1383:8
#7 0x7fba2aa1ac1b in dissector_try_uint epan/packet.c:1407:9
#8 0x7fba290510ab in decode_udp_ports epan/dissectors/packet-udp.c:666:7
#9 0x7fba2906429f in dissect epan/dissectors/packet-udp.c:1127:5
#10 0x7fba29055c8d in dissect_udp epan/dissectors/packet-udp.c:1133:3
#11 0x7fba2aa2f685 in call_dissector_through_handle epan/packet.c:706:9
#12 0x7fba2aa1a388 in call_dissector_work epan/packet.c:791:9
#13 0x7fba2aa2896a in call_dissector_only epan/packet.c:3141:8
#14 0x7fba2aa2c70b in call_all_postdissectors epan/packet.c:3516:3
#15 0x7fba277735e9 in dissect_frame epan/dissectors/packet-frame.c:681:5
#16 0x7fba2aa2f685 in call_dissector_through_handle epan/packet.c:706:9
#17 0x7fba2aa1a388 in call_dissector_work epan/packet.c:791:9
#18 0x7fba2aa2896a in call_dissector_only epan/packet.c:3141:8
#19 0x7fba2aa120b4 in call_dissector_with_data epan/packet.c:3154:8
#20 0x7fba2aa11408 in dissect_record epan/packet.c:580:3
#21 0x7fba2a9c0bd8 in epan_dissect_run epan/epan.c:534:2
#22 0x55afeb65c61e in LLVMFuzzerTestOneInput fuzz/fuzzshark.c:360:2
#23 0x55afeb65f017 in main fuzz/StandaloneFuzzTargetMain.c:122:5
#24 0x7fba1c43b222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
#25 0x55afeb5484cd in _start (run/fuzzshark+0x234cd)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
epan/dissectors/packet-iax2.c:721:35 in 
epan/dissectors/packet-iax2.c:1902:93: runtime error: shift exponent 4294967295
is too large for 64-bit type 'unsigned long'
#0 0x7fba27a82616 in dissect_fullpacket
epan/dissectors/packet-iax2.c:1902:93
#1 0x7fba27a7fbb4 in dissect_iax2 epan/dissectors/packet-iax2.c:1232:13
#2 0x7fba2aa2f685 in call_dissector_through_handle epan/packet.c:706:9
#3 0x7fba2aa1a388 in call_dissector_work epan/packet.c:791:9
#4 0x7fba2aa19428 in dissector_try_uint_new epan/packet.c:1383:8
#5 0x7fba2aa1ac1b in dissector_try_uint epan/packet.c:1407:9
#6 0x7fba290510ab in decode_udp_ports epan/dissectors/packet-udp.c:666:7
#7 0x7fba2906429f in dissect epan/dissectors/packet-udp.c:1127:5
#8 0x7fba29055c8d in dissect_udp epan/dissectors/packet-udp.c:1133:3
#9 0x7fba2aa2f685 in call_dissector_through_handle epan/packet.c:706:9
#10 0x7fba2aa1a388 in call_dissector_work epan/packet.c:791:9
#11 0x7fba2aa2896a in call_dissector_only epan/packet.c:3141:8
#12 0x7fba2aa2c70b in call_all_postdissectors epan/packet.c:3516:3
#13 0x7fba277735e9 in dissect_frame epan/dissectors/packet-frame.c:681:5
#14 0x7fba2aa2f685 in call_dissector_through_handle epan/packet.c:706:9
#15 0x7fba2aa1a388 in call_dissector_work epan/packet.c:791:9
#16 0x7fba2aa2896a in call_dissector_only epan/packet.c:3141:8
#17 0x7fba2aa120b4 in call_dissector_with_data epan/packet.c:3154:8
#18 0x7fba2aa11408 in dissect_record epan/packet.c:580:3
#19 0x7fba2a9c0bd8 in epan_dissect_run epan/epan.c:534:2
#20 0x55afeb65c61e in LLVMFuzzerTestOneInput fuzz/fuzzshark.c:360:2
#21 0x55afeb65f017 in main fuzz/StandaloneFuzzTargetMain.c:122:5
#22 0x7fba1c43b222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
#23 0x55afeb5484cd in _start (run/fuzzshark+0x234cd)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
epan/dissectors/packet-iax2.c:1902:93 in

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15251] [oss-fuzz] UBSAN: null pointer passed as argument 2, which is declared to never be null in packet-iax2.c:721:35

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15251

--- Comment #1 from Peter Wu  ---
Created attachment 16688
  --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=16688=edit
Packet capture file

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15251] New: [oss-fuzz] UBSAN: null pointer passed as argument 2, which is declared to never be null in packet-iax2.c:721:35

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15251

Bug ID: 15251
   Summary: [oss-fuzz] UBSAN: null pointer passed as argument 2,
which is declared to never be null in
packet-iax2.c:721:35
   Product: Wireshark
   Version: Git
  Hardware: x86-64
   URL: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=
11180
OS: Linux
Status: CONFIRMED
  Severity: Major
  Priority: High
 Component: Dissection engine (libwireshark)
  Assignee: bugzilla-ad...@wireshark.org
  Reporter: pe...@lekensteyn.nl
  Target Milestone: ---

Build Information:
TShark (Wireshark) 2.9.0 (v2.9.0rc0-2375-gc6721248)

Copyright 1998-2018 Gerald Combs  and contributors.
License GPLv2+: GNU GPL version 2 or later

This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3,
with GLib 2.58.1, with zlib 1.2.11, without SMI, with c-ares 1.15.0, with Lua
5.2.4, with GnuTLS 3.5.19, with Gcrypt 1.8.4, with MIT Kerberos, with MaxMind
DB
resolver, with nghttp2 1.34.0, with LZ4, with Snappy, with libxml2 2.9.8.

Running on Linux 4.18.7-arch1-1-ARCH, with Intel(R) Core(TM) i7-6700HQ CPU @
2.60GHz (with SSE4.2), with 32052 MB of physical memory, with locale C, with
libpcap version 1.9.0-PRE-GIT (with TPACKET_V3), with GnuTLS 3.5.19, with
Gcrypt
1.8.4, with zlib 1.2.11, binary plugins supported (13 loaded).

Built using clang 4.2.1 Compatible Clang 7.0.0 (tags/RELEASE_700/final).
--
A problem was found by the oss-fuzz project:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11180

Attached is the sample that triggers this error which can be reproduced with an
ASAN+UBSAN build of Wireshark:
tshark -Vxr
clusterfuzz-testcase-minimized-fuzzshark_ip_proto-udp-5680214932193280.pcap
--
epan/dissectors/packet-iax2.c:721:35: runtime error: null pointer passed as
argument 2, which is declared to never be null
/usr/include/string.h:43:28: note: nonnull attribute specified here
#0 0x7f3251e0896e in iax_circuit_lookup epan/dissectors/packet-iax2.c:721:5
#1 0x7f3251e03851 in iax_lookup_call epan/dissectors/packet-iax2.c:973:20
#2 0x7f3251dfd64b in dissect_fullpacket
epan/dissectors/packet-iax2.c:1790:18
#3 0x7f3251dfcbb4 in dissect_iax2 epan/dissectors/packet-iax2.c:1232:13
#4 0x7f3254dac685 in call_dissector_through_handle epan/packet.c:706:9
#5 0x7f3254d97388 in call_dissector_work epan/packet.c:791:9
#6 0x7f3254d96428 in dissector_try_uint_new epan/packet.c:1383:8
#7 0x7f3254d97c1b in dissector_try_uint epan/packet.c:1407:9
#8 0x7f32533ce0ab in decode_udp_ports epan/dissectors/packet-udp.c:666:7
#9 0x7f32533e129f in dissect epan/dissectors/packet-udp.c:1127:5
#10 0x7f32533d2c8d in dissect_udp epan/dissectors/packet-udp.c:1133:3
#11 0x7f3254dac685 in call_dissector_through_handle epan/packet.c:706:9
#12 0x7f3254d97388 in call_dissector_work epan/packet.c:791:9
#13 0x7f3254d96428 in dissector_try_uint_new epan/packet.c:1383:8
#14 0x7f32519cf165 in dissect_exported_pdu
epan/dissectors/packet-exported_pdu.c:370:17
#15 0x7f3254dac685 in call_dissector_through_handle epan/packet.c:706:9
#16 0x7f3254d97388 in call_dissector_work epan/packet.c:791:9
#17 0x7f3254d96428 in dissector_try_uint_new epan/packet.c:1383:8
#18 0x7f3251aee880 in dissect_frame epan/dissectors/packet-frame.c:579:11
#19 0x7f3254dac685 in call_dissector_through_handle epan/packet.c:706:9
#20 0x7f3254d97388 in call_dissector_work epan/packet.c:791:9
#21 0x7f3254da596a in call_dissector_only epan/packet.c:3141:8
#22 0x7f3254d8f0b4 in call_dissector_with_data epan/packet.c:3154:8
#23 0x7f3254d8e408 in dissect_record epan/packet.c:580:3
#24 0x7f3254d3dc38 in epan_dissect_run_with_taps epan/epan.c:547:2
#25 0x56139470a510 in process_packet_single_pass tshark.c:3572:5
#26 0x561394710299 in process_cap_file tshark.c:3403:11
#27 0x561394703006 in real_main tshark.c:2046:17
#28 0x5613946fa1d1 in main tshark.c:2274:10
#29 0x7f3246700222 in __libc_start_main (/usr/lib/libc.so.6+0x24222)
#30 0x5613945d24dd in _start (run/tshark+0xdb4dd)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
epan/dissectors/packet-iax2.c:721:35 in

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15230] tshark 2.6 does not print geoIP information

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15230

Peter Wu  changed:

   What|Removed |Added

  Component|TShark  |Build process
 CC||bal...@balintreczey.hu,
   ||pe...@lekensteyn.nl
 Ever confirmed|0   |1
 Status|UNCONFIRMED |CONFIRMED

--- Comment #2 from Peter Wu  ---
This issue was also reported on SharkFest'18 EU and I can confirm it is missing
for 2.6.3-1~ubuntu18.04.1.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15230] tshark 2.6 does not print geoIP information

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15230

--- Comment #1 from Gerrit Code Review  ---
Change 30439 had a related patch set uploaded by Peter Wu:
debian: install required GeoIP resolver executable and manual page

https://code.wireshark.org/review/30439

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15241] Wireshark 2.6.3 crashes in QIcon destructor on closing the main window on Ubuntu 14.04 and 16.04

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15241

--- Comment #4 from Peter Wu  ---
(In reply to Balint Reczey from comment #3)
> (In reply to Peter Wu from comment #2)
> > Was this issue also present on Debian stretch/buster or other Ubuntu
> > versions?
> > Is this limited to the standard (Unity?) UI or is it also present on 
> > Kubuntu?
> 
> I have not checked Debian, but I could not reproduce it with Trusty's KDE
> and Fluxbox thus it seems to be Unity-specific.

KDE with the Breeze theme used to have a crash on exit as well which was caused
by a bug in the Breeze style plugin:
https://bugs.launchpad.net/ubuntu/+source/breeze/+bug/1545783

If this issue is only affecting Unity, then it might be worth looking into its
Qt integration plugin.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14659] NTP Analysis: Delta time between Client-Server

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14659

Pascal Quantin  changed:

   What|Removed |Added

 CC||pascal.quan...@gmail.com

--- Comment #6 from Pascal Quantin  ---
I'll have a look at it. Feel free to come to the developer den to see the
progress (if any :p).

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14349] Closing Enabled Protocols dialog crashes wireshark

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14349

--- Comment #11 from Peter Wu  ---
(In reply to Kevin from comment #9)
> The crash is fixed, but the root cause of the bug is not fixed.

The root cause of the crash is actually fixed. As the warnings have no other
nasty effects, it is unlikely to be addressed. The way forward is to use the Qt
UI. Are you in a position to build Wireshark with Qt or are you relying on what
Oracle provides?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15241] Wireshark 2.6.3 crashes in QIcon destructor on closing the main window on Ubuntu 14.04 and 16.04

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15241

--- Comment #3 from Balint Reczey  ---
(In reply to Peter Wu from comment #2)
> Was this issue also present on Debian stretch/buster or other Ubuntu
> versions?
> Is this limited to the standard (Unity?) UI or is it also present on Kubuntu?

I have not checked Debian, but I could not reproduce it with Trusty's KDE and
Fluxbox thus it seems to be Unity-specific.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15249] RTPS: reassembly fixes

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15249

--- Comment #2 from Gerrit Code Review  ---
Change 30435 merged by Anders Broman:
RTPS: fixed issues in the reassembly logic of DATA_FRAG

https://code.wireshark.org/review/30435

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15248] Tshark piping output in a cmd or powershell prompt stops working when GeoIP is enabled

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15248

Peter Wu  changed:

   What|Removed |Added

 Ever confirmed|0   |1
   See Also||https://bugs.wireshark.org/
   ||bugzilla/show_bug.cgi?id=15
   ||122
 Status|UNCONFIRMED |CONFIRMED
 CC||pe...@lekensteyn.nl

--- Comment #1 from Peter Wu  ---
Thanks for the detailed report, this might be the same issue as bug 15122.

I can reproduce the issue on Windows 7 x64 with Wireshark 2.6.3. For some
reason the mmdbresolv.exe process does not exit when used in a pipe (tshark.exe
has already exited though).

Terminating the mmdbresolv.exe child process of Wireshark.exe is not
sufficient, only after terminating the parent (Wireshark.exe), all other
mmdbresolv.exe processes will exit and then sort will also complete
successfully.

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15122] tshark.exe usage creates orphaned mmdbresolve.exe processes

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15122

Peter Wu  changed:

   What|Removed |Added

   See Also||https://bugs.wireshark.org/
   ||bugzilla/show_bug.cgi?id=15
   ||248

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15245] Add dissector for Apple Wireless Direct Link (AWDL)

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15245

Jaap Keuter  changed:

   What|Removed |Added

 Ever confirmed|0   |1
 Status|UNCONFIRMED |IN_PROGRESS

--- Comment #1 from Jaap Keuter  ---
Code change: https://code.wireshark.org/review/30413
Based on: https://dl.acm.org/citation.cfm?doid=3241539.3241566

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 15241] Wireshark 2.6.3 crashes in QIcon destructor on closing the main window on Ubuntu 14.04 and 16.04

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15241

Peter Wu  changed:

   What|Removed |Added

 CC||pe...@lekensteyn.nl

--- Comment #2 from Peter Wu  ---
Was this issue also present on Debian stretch/buster or other Ubuntu versions?
Is this limited to the standard (Unity?) UI or is it also present on Kubuntu?

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe

[Wireshark-bugs] [Bug 14349] Closing Enabled Protocols dialog crashes wireshark

[bugzilla-daemon]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14349

Alexis La Goutte  changed:

   What|Removed |Added

 CC||alexis.lagou...@gmail.com

--- Comment #10 from Alexis La Goutte  ---
(In reply to Kevin from comment #9)
> The crash is fixed, but the root cause of the bug is not fixed.
> If Wireshark is started from the terminal command line, I still get the 4
> warning messages displayed on opening the Enable Protocols window.
> "(wireshark-gtk:2264): Gtk-WARNING **: gkwidget.c:5628: widget not within a
> GtkWindow" 4 times. This is in Wireshark 2.6.3. Same applies to 2.4.2.

Hi Kevin,

Like it is say, there is no more dev on GTK GUI... (and it is only warning...)

-- 
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list 
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
 mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe