Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 8854] New: Zooming out (Ctrl+-) too far crashes Wireshark.

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	8854
Summary	Zooming out (Ctrl+-) too far crashes Wireshark.
Classification	Unclassified
Product	Wireshark
Version	SVN
Hardware	x86-64
OS	Windows 7
Status	UNCONFIRMED
Severity	Major
Priority	Low
Component	Wireshark
Assignee	bugzilla-admin@wireshark.org
Reporter	christopher.maynard@gtech.com

Build Information:
Version 1.11.0 (SVN Rev 50167 from /trunk)

Compiled (64-bit) with GTK+ 2.24.14, with Cairo 1.10.2, with Pango 1.30.1, with
GLib 2.34.1, with WinPcap (4_1_3), with libz 1.2.5, without POSIX capabilities,
without libnl, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.1, without Python,
with GnuTLS 2.12.18, with Gcrypt 1.4.6, without Kerberos, with GeoIP, with
PortAudio V19-devel (built Jun 25 2013), with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version
4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 2.12.18, Gcrypt 1.4.6, without AirPcap.
       Intel(R) Core(TM) i5-2540M CPU @ 2.60GHz, with 8072MB of physical
memory.


Built using Microsoft Visual C++ 10.0 build 30319
--
On my system, it takes about 10 iterations of zooming out before the crash
occurs.

Call stack:

>	Wireshark.exe!bytes_view_adjustment_set(_BytesView * bv)  Line 980 + 0x1c bytes	C
     Wireshark.exe!bytes_view_set_scroll_adjustments(_BytesView * bv,
_GtkAdjustment * hadj, _GtkAdjustment * vadj)  Line 1079    C
     Wireshark.exe!bv_VOID__OBJECT_OBJECT(_GClosure * closure, _GValue *
return_value, unsigned int n_params, const _GValue * param_values, void * hint,
void * marshal_data)  Line 1177    C
     libgobject-2.0-0.dll!0000000058935c09()     
     [Frames below may be incorrect and/or missing, no symbols loaded for
libgobject-2.0-0.dll]    
     libgobject-2.0-0.dll!0000000058945509()     
     libgobject-2.0-0.dll!000000005894cc1a()     
     libgobject-2.0-0.dll!000000005894cd98()     
     libgtk-win32-2.0-0.dll!000000005721474f()     
     libgtk-win32-2.0-0.dll!00000000571637ca()     
     libgobject-2.0-0.dll!0000000058938701()     
     libgobject-2.0-0.dll!0000000058935e76()     
     libgobject-2.0-0.dll!000000005894c5cf()     
     libgobject-2.0-0.dll!000000005894cd98()     
     Wireshark.exe!add_byte_tab(_GtkWidget * byte_nb, const char * name, tvbuff
* tvb, _proto_node * tree, _GtkWidget * tree_view)  Line 477    C
     Wireshark.exe!add_byte_views(_epan_dissect_t * edt, _GtkWidget *
tree_view, _GtkWidget * byte_nb_ptr)  Line 520    C
     Wireshark.exe!main_cf_cb_packet_selected(void * data)  Line 1691    C
     Wireshark.exe!main_cf_callback(int event, void * data, void * user_data) 
Line 1777    C
     Wireshark.exe!cf_callback_invoke(int event, void * data)  Line 186    C
     Wireshark.exe!cf_select_packet(_capture_file * cf, int row)  Line 3758   
C
     Wireshark.exe!packet_list_select_cb(_GtkTreeView * tree_view, void * data)
 Line 1241    C
     libgobject-2.0-0.dll!0000000058935e76()     
     libgobject-2.0-0.dll!000000005894c5cf()     
     libgobject-2.0-0.dll!000000005894cd98()     
     libgtk-win32-2.0-0.dll!00000000571f91c1()     
     libgtk-win32-2.0-0.dll!00000000571f97b8()     
     libgtk-win32-2.0-0.dll!00000000571f9881()     
     Wireshark.exe!scroll_to_and_select_iter(_GtkTreeModel * model,
_GtkTreeSelection * selection, _GtkTreeIter * iter)  Line 1048    C
     Wireshark.exe!packet_list_select_row_from_data(_frame_data * fdata_needle)
 Line 1161    C
     Wireshark.exe!cf_goto_frame(_capture_file * cf, unsigned int fnumber) 
Line 3640 + 0xa bytes    C
     Wireshark.exe!redraw_packet_bytes_all()  Line 194    C
     Wireshark.exe!user_font_apply()  Line 251    C
     Wireshark.exe!view_zoom_out_cb(_GtkWidget * w, void * d)  Line 106 + 0x5
bytes    C


The exception:

Unhandled exception at 0x000000013f28354b in Wireshark.exe: 0xC0000094: Integer
division by zero.

So the exception occurs in ui/gtk/bytes_view.c, line 980 because bv->fontsize
is zero:

980: page_size = (allocation.height - bv->font_descent) / bv->fontsize;


There are other cases where division by zero could theoretically occur as well,
although I haven't verified if all of these cases are potential problems or
not:

In bytes_view_render():
828:        line = area->y / bv->fontsize;
829:        lines_max = 1 + (area->y + area->height) / bv->fontsize;

855:        lines_max_full = (height / bv->fontsize) + 1;

In bytes_view_adjustment_set():
976:         upper = (int) (bv->len / bv->per_line);
977:        if ((bv->len % bv->per_line))
980:        page_size = (allocation.height - bv->font_descent) / bv->fontsize;

In bytes_view_byte_from_xy():
1327:    char_y = (int) gtk_adjustment_get_value(bytes_view_ensure_vadj(bv)) +
(y / bv->fontsize);

In bytes_view_scroll_to_byte():
1360:    line = byte / bv->per_line;

---

      You are receiving this mail because:

• You are watching all bug changes.