Wireshark-bugs: [Wireshark-bugs] [Bug 6663] New: Large packet length crashes Wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 12 Dec 2011 10:57:48 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6663

           Summary: Large packet length crashes Wireshark
           Product: Wireshark
           Version: SVN
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Critical
          Priority: Low
         Component: Wireshark
        AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
        ReportedBy: gerald@xxxxxxxxxxxxx


Build Information:
Paste the COMPLETE build information from "Help->About Wireshark", "wireshark
-v", or "tshark -v".
--
Laurent Butti discovered the following:

----

Here is an airopeek file triggering a SIGSEGV (allowing remote attackers to
cause a denial of service). It was successfully tested on 1.6.3 and 1.6.4
releases.

If you need further information, feel free to ask.

Thanks,
Laurent Butti.

----

(gdb) run
Starting program: /usr/local/bin/tshark -nVxr test2.apc

Program received signal SIGSEGV, Segmentation fault.
0x08056422 in print_hex_data (stream=0x88037a8, edt=0xbfffe624) at print.c:847
847        multiple_sources = (edt->pi.data_src->next != NULL);
(gdb) bt
#0  0x08056422 in print_hex_data (stream=0x88037a8, edt=0xbfffe624)
    at print.c:847
#1  0x0806c529 in print_packet (cf=<optimized out>, edt=<optimized out>)
    at tshark.c:3298
#2  0x0806df16 in process_packet (cf=0x8081e20, offset=<optimized out>,
    whdr=0x88037cc, pseudo_header=0x88037e0, pd=0x8808648 "\200",
    filtering_tap_listeners=<optimized out>, tap_flags=4) at tshark.c:2918
#3  0x08051fd6 in load_cap_file (max_byte_count=0, max_packet_count=0,
    out_file_name_res=0, out_file_type=-1073747096, save_file=0x0,
    cf=<optimized out>) at tshark.c:2718
#4  main (argc=3, argv=0xbfffec74) at tshark.c:1717

Breakpoint 1, print_hex_data (stream=0x88037a8, edt=0xbfffe624) at print.c:831
831    {
(gdb) step
847        multiple_sources = (edt->pi.data_src->next != NULL);
(gdb) print edt
$2 = (epan_dissect_t *) 0xbfffe624
(gdb) print edt->pi.data_src
$3 = (GSList *) 0x0

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.