Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10496] New: Buildbot crash output: fuzz-2014-09-22-10872.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	10496
Summary	Buildbot crash output: fuzz-2014-09-22-10872.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2014-09-22-10872.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2014-09-22-10872.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/7063-RPC_EPM_TEST.pcap

Build host information:
Linux wsbb04 3.13.0-35-generic #62-Ubuntu SMP Fri Aug 15 01:58:42 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.1 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=2968
BUILDBOT_URL=http://buildbot.wireshark.org/trunk/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=5e231d1d9cb90471344f0fff80f3cea0a57e718b

Return value:  0

Dissector bug:  0

Valgrind error count:  12



Git commit
commit 5e231d1d9cb90471344f0fff80f3cea0a57e718b
Author: Guy Harris <guy@alum.mit.edu>
Date:   Sat Sep 20 15:51:10 2014 -0700

    Fix wslua_filehandler_open() to work as wiretap open routines should.

    They should return 1 on success, -1 on error, and 0 if there was no
    error but the file isn't one of the type for the routine.  They must not
    return any other value.  If they return -1, they must set *err.

    Change-Id: I0f1e1675b4cc8f0214ad67a23de0e4ecb09cabea
    Reviewed-on: https://code.wireshark.org/review/4221
    Reviewed-by: Guy Harris <guy@alum.mit.edu>


Command and args: ./tools/valgrind-wireshark.sh 

==6118== Memcheck, a memory error detector
==6118== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==6118== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright info
==6118== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2014-09-22-10872.pcap
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6838A37: dissect_ndr_uint3264 (packet-dcerpc-ndr.c:239)
==6118==    by 0x6868BDC: dissect_ndr_ucvarray_core (packet-dcerpc.c:1788)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D039: dissect_deferred_pointers (packet-dcerpc.c:2321)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118==    by 0x686B95E: dissect_dcerpc_dg_stub.constprop.13
(packet-dcerpc.c:5312)
==6118==    by 0x686C894: dissect_dcerpc_dg (packet-dcerpc.c:5524)
==6118==    by 0x66686D9: dissector_try_heuristic (packet.c:2028)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6838A37: dissect_ndr_uint3264 (packet-dcerpc-ndr.c:239)
==6118==    by 0x6868C2C: dissect_ndr_ucvarray_core (packet-dcerpc.c:1793)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D039: dissect_deferred_pointers (packet-dcerpc.c:2321)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118==    by 0x686B95E: dissect_dcerpc_dg_stub.constprop.13
(packet-dcerpc.c:5312)
==6118==    by 0x686C894: dissect_dcerpc_dg (packet-dcerpc.c:5524)
==6118==    by 0x66686D9: dissector_try_heuristic (packet.c:2028)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6838A37: dissect_ndr_uint3264 (packet-dcerpc-ndr.c:239)
==6118==    by 0x6868C77: dissect_ndr_ucvarray_core (packet-dcerpc.c:1798)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D039: dissect_deferred_pointers (packet-dcerpc.c:2321)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118==    by 0x686B95E: dissect_dcerpc_dg_stub.constprop.13
(packet-dcerpc.c:5312)
==6118==    by 0x686C894: dissect_dcerpc_dg (packet-dcerpc.c:5524)
==6118==    by 0x66686D9: dissector_try_heuristic (packet.c:2028)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6838A37: dissect_ndr_uint3264 (packet-dcerpc-ndr.c:239)
==6118==    by 0x686D196: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2656)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6696F1A: tvb_ensure_bytes_exist (tvbuff.c:542)
==6118==    by 0x686D1AA: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2658)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6696F20: tvb_ensure_bytes_exist (tvbuff.c:551)
==6118==    by 0x686D1AA: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2658)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6696F27: tvb_ensure_bytes_exist (tvbuff.c:553)
==6118==    by 0x686D1AA: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2658)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6696F2B: tvb_ensure_bytes_exist (tvbuff.c:584)
==6118==    by 0x686D1AA: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2658)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6696F30: tvb_ensure_bytes_exist (tvbuff.c:587)
==6118==    by 0x686D1AA: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2658)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x686D5F5: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2684)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118==    by 0x686B95E: dissect_dcerpc_dg_stub.constprop.13
(packet-dcerpc.c:5312)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x68694B3: add_pointer_to_list.isra.1 (packet-dcerpc.c:2414)
==6118==    by 0x686D554: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2691)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x68284A0: epm_dissect_ept_entry_t (packet-dcerpc-epm.c:174)
==6118==    by 0x6868D78: dissect_ndr_ucvarray_core (packet-dcerpc.c:1817)
==6118==    by 0x686A3FA: dissect_ndr_ucvarray (packet-dcerpc.c:1840)
==6118==    by 0x6828373: epm_dissect_ept_entry_t_array
(packet-dcerpc-epm.c:203)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118== 
==6118== Conditional jump or move depends on uninitialised value(s)
==6118==    at 0x6838A37: dissect_ndr_uint3264 (packet-dcerpc-ndr.c:239)
==6118==    by 0x6828706: epm_dissect_tower (packet-dcerpc-epm.c:478)
==6118==    by 0x686D06C: dissect_deferred_pointers (packet-dcerpc.c:2372)
==6118==    by 0x686D403: dissect_ndr_pointer_cb.part.10 (packet-dcerpc.c:2703)
==6118==    by 0x686D6FF: dissect_ndr_pointer (packet-dcerpc.c:2718)
==6118==    by 0x6828096: epm_dissect_ept_lookup_resp (packet-dcerpc-epm.c:220)
==6118==    by 0x686B5ED: dcerpc_try_handoff (packet-dcerpc.c:2993)
==6118==    by 0x686B95E: dissect_dcerpc_dg_stub.constprop.13
(packet-dcerpc.c:5312)
==6118==    by 0x686C894: dissect_dcerpc_dg (packet-dcerpc.c:5524)
==6118==    by 0x66686D9: dissector_try_heuristic (packet.c:2028)
==6118==    by 0x6D979AA: decode_udp_ports (packet-udp.c:501)
==6118==    by 0x6D982E6: dissect (packet-udp.c:839)
==6118== 
==6118== 
==6118== HEAP SUMMARY:
==6118==     in use at exit: 1,216,050 bytes in 29,589 blocks
==6118==   total heap usage: 223,345 allocs, 193,756 frees, 28,421,790 bytes
allocated
==6118== 
==6118== LEAK SUMMARY:
==6118==    definitely lost: 5,384 bytes in 165 blocks
==6118==    indirectly lost: 36,648 bytes in 49 blocks
==6118==      possibly lost: 0 bytes in 0 blocks
==6118==    still reachable: 1,174,018 bytes in 29,375 blocks
==6118==         suppressed: 0 bytes in 0 blocks
==6118== Rerun with --leak-check=full to see details of leaked memory
==6118== 
==6118== For counts of detected and suppressed errors, rerun with: -v
==6118== Use --track-origins=yes to see where uninitialised values come from
==6118== ERROR SUMMARY: 12 errors from 12 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.