https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14206
Bug ID: 14206
Summary: Buildbot crash output: fuzz-2017-11-11-12442.pcap
Product: Wireshark
Version: unspecified
Hardware: x86-64
OS: Ubuntu
Status: CONFIRMED
Severity: Major
Priority: High
Component: Dissection engine (libwireshark)
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Problems have been found with the following capture file:
https://www.wireshark.org/download/automated/captures/fuzz-2017-11-11-12442.pcap
stderr:
Input file: /home/wireshark/menagerie/menagerie/6987-dvbci_sasTest.pcap
Build host information:
Linux wsbb04 4.4.0-97-generic #120-Ubuntu SMP Tue Sep 19 17:28:18 UTC 2017
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID: Ubuntu
Description: Ubuntu 16.04.3 LTS
Release: 16.04
Codename: xenial
Buildbot information:
BUILDBOT_REPOSITORY=ssh://[email protected]:29418/wireshark
BUILDBOT_WORKERNAME=clang-code-analysis
BUILDBOT_BUILDNUMBER=4309
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_GOT_REVISION=bce5b50f734bfd63b29ce44bfce29cb2d0d094b9
Return value: 0
Dissector bug: 0
Valgrind error count: 1
Git commit
commit bce5b50f734bfd63b29ce44bfce29cb2d0d094b9
Author: Peter Wu <[email protected]>
Date: Sat Nov 11 03:25:36 2017 +0000
Qt: Fix use-after-free crashes when changing packets
QTabWidget::clear() is documented to remove all tabs without deleting
them. As a result, findByteViewTextForTvb will still find ByteViewText
children with freed tvbs. Fix this by deleting the tabs too.
Change-Id: I5b4fdc7154a3804e3bd5f360749e95d178ffe580
Bug: 14199
Fixes: v2.5.0rc0-1532-g56a130a152 ("ByteViewText: Remove epan dependancy")
Reviewed-on: https://code.wireshark.org/review/24339
Petri-Dish: Peter Wu <[email protected]>
Reviewed-by: Stig Bjørlykke <[email protected]>
==22558== Memcheck, a memory error detector
==22558== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==22558== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==22558== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2017-11-11-12442.pcap
==22558==
==22558== Invalid read of size 8
==22558== at 0x7C3B8D3: conversation_get_dissector (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6ABF04E: dissect_dvbci_payload_sas (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC427C: dissect_dvbci_apdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC3DA3: dissect_dvbci_spdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC2FA7: dissect_dvbci_tpdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC2942: dissect_dvbci_lpdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6ABAFDA: dissect_dvbci (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C59A29: call_dissector_through_handle (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C55A69: call_dissector_work (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C55877: dissector_try_uint_new (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6B5CFC4: dissect_frame (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C59A29: call_dissector_through_handle (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== Address 0x30 is not stack'd, malloc'd or (recently) free'd
==22558==
==22558==
==22558== Process terminating with default action of signal 11 (SIGSEGV):
dumping core
==22558== Access not within mapped region at address 0x30
==22558== at 0x7C3B8D3: conversation_get_dissector (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6ABF04E: dissect_dvbci_payload_sas (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC427C: dissect_dvbci_apdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC3DA3: dissect_dvbci_spdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC2FA7: dissect_dvbci_tpdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6AC2942: dissect_dvbci_lpdu (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6ABAFDA: dissect_dvbci (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C59A29: call_dissector_through_handle (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C55A69: call_dissector_work (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C55877: dissector_try_uint_new (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x6B5CFC4: dissect_frame (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== by 0x7C59A29: call_dissector_through_handle (in
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/lib/libwireshark.so.0.0.0)
==22558== If you believe this happened as a result of a stack
==22558== overflow in your program's main thread (unlikely but
==22558== possible), you can try to increase the size of the
==22558== main thread stack using the --main-stacksize= flag.
==22558== The main thread stack size used in this run was 2084864.
==22558==
==22558== HEAP SUMMARY:
==22558== in use at exit: 30,114,302 bytes in 277,061 blocks
==22558== total heap usage: 323,038 allocs, 45,977 frees, 43,301,094 bytes
allocated
==22558==
==22558== LEAK SUMMARY:
==22558== definitely lost: 0 bytes in 0 blocks
==22558== indirectly lost: 0 bytes in 0 blocks
==22558== possibly lost: 0 bytes in 0 blocks
==22558== still reachable: 29,898,683 bytes in 276,250 blocks
==22558== suppressed: 215,619 bytes in 811 blocks
==22558== Rerun with --leak-check=full to see details of leaked memory
==22558==
==22558== For counts of detected and suppressed errors, rerun with: -v
==22558== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
./tools/valgrind-wireshark.sh: line 149: 22558 Segmentation fault (core
dumped) $cmdline > /dev/null
[ no debug trace ]
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:[email protected]?subject=unsubscribe
