Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 11591] New: Buildbot crash output: fuzz-2015-10-12-27049.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	11591
Summary	Buildbot crash output: fuzz-2015-10-12-27049.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2015-10-12-27049.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2015-10-12-27049.pcap

stderr:
Input file: /home/wireshark/menagerie/menagerie/8431-anyeth

Build host information:
Linux wsbb04 3.13.0-65-generic #105-Ubuntu SMP Mon Sep 21 18:50:58 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 14.04.3 LTS
Release:    14.04
Codename:    trusty

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_BUILDNUMBER=3335
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_SLAVENAME=clang-code-analysis
BUILDBOT_GOT_REVISION=69a70df0a0fa0d9953a66222006a45af5572ff04

Return value:  0

Dissector bug:  0

Valgrind error count:  11



Git commit
commit 69a70df0a0fa0d9953a66222006a45af5572ff04
Author: João Valverde <joao.valverde@tecnico.ulisboa.pt>
Date:   Fri Oct 9 10:10:31 2015 +0100

    IPv6: Set destination address for RPL routing header

    Change-Id: I5d83370424cc0002a0bf965138b7fbdad69557fb
    Reviewed-on: https://code.wireshark.org/review/10895
    Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
    Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
    Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>


Command and args: ./tools/valgrind-wireshark.sh -T

==11692== Memcheck, a memory error detector
==11692== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==11692== Using Valgrind-3.10.0.SVN and LibVEX; rerun with -h for copyright
info
==11692== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install/bin/tshark
-Vx -nr
/fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2015-10-12-27049.pcap
==11692== 
==11692== Conditional jump or move depends on uninitialised value(s)
==11692==    at 0x4C2E0F8: strlen (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11692==    by 0xA1BAB02: g_strdup (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==11692==    by 0x68515AF: string_fvalue_set_string (ftype-string.c:51)
==11692==    by 0x6818A60: proto_tree_add_string (proto.c:3296)
==11692==    by 0x6D32F93: dissect_ncp_request (packet-ncp2222.inc:7316)
==11692==    by 0x6D4251D: dissect_ncp_common (packet-ncp.c:1016)
==11692==    by 0x6D417CD: dissect_ncp_tcp_pdu (packet-ncp.c:1143)
==11692==    by 0x6F6F967: tcp_dissect_pdus (packet-tcp.c:2487)
==11692==    by 0x6D41761: dissect_ncp_tcp (packet-ncp.c:1150)
==11692==    by 0x680172F: call_dissector_work (packet.c:618)
==11692==    by 0x68015CE: dissector_try_uint_new (packet.c:1163)
==11692==    by 0x6F6FC63: decode_tcp_ports (packet-tcp.c:4136)
==11692== 
==11692== Conditional jump or move depends on uninitialised value(s)
==11692==    at 0x4C2E0F8: strlen (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11692==    by 0x681C8DE: proto_item_fill_label (proto.c:4398)
==11692==    by 0x680DD62: proto_tree_print_node (print.c:163)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DE8B: proto_tree_print_node (print.c:218)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DCFD: proto_tree_print (print.c:132)
==11692==    by 0x4143C9: print_packet (tshark.c:4129)
==11692==    by 0x413971: process_packet (tshark.c:3739)
==11692==    by 0x410E3E: main (tshark.c:3481)
==11692== 
==11692== Use of uninitialised value of size 8
==11692==    at 0x682CDDE: format_text (strutil.c:185)
==11692==    by 0x681C8E9: proto_item_fill_label (proto.c:4398)
==11692==    by 0x680DD62: proto_tree_print_node (print.c:163)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DE8B: proto_tree_print_node (print.c:218)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DCFD: proto_tree_print (print.c:132)
==11692==    by 0x4143C9: print_packet (tshark.c:4129)
==11692==    by 0x413971: process_packet (tshark.c:3739)
==11692==    by 0x410E3E: main (tshark.c:3481)
==11692== 
==11692== Conditional jump or move depends on uninitialised value(s)
==11692==    at 0x682CE0C: format_text (strutil.c:191)
==11692==    by 0x681C8E9: proto_item_fill_label (proto.c:4398)
==11692==    by 0x680DD62: proto_tree_print_node (print.c:163)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DE8B: proto_tree_print_node (print.c:218)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DCFD: proto_tree_print (print.c:132)
==11692==    by 0x4143C9: print_packet (tshark.c:4129)
==11692==    by 0x413971: process_packet (tshark.c:3739)
==11692==    by 0x410E3E: main (tshark.c:3481)
==11692== 
==11692== Conditional jump or move depends on uninitialised value(s)
==11692==    at 0xA1BB1C1: g_strlcpy (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4002.0)
==11692==    by 0x681C959: proto_item_fill_label (proto.c:6438)
==11692==    by 0x680DD62: proto_tree_print_node (print.c:163)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DE8B: proto_tree_print_node (print.c:218)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DCFD: proto_tree_print (print.c:132)
==11692==    by 0x4143C9: print_packet (tshark.c:4129)
==11692==    by 0x413971: process_packet (tshark.c:3739)
==11692==    by 0x410E3E: main (tshark.c:3481)
==11692== 
==11692== Conditional jump or move depends on uninitialised value(s)
==11692==    at 0x4C2E0F8: strlen (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==11692==    by 0xC55873E: fputs (iofputs.c:35)
==11692==    by 0x68106FF: print_line_text (print_stream.c:131)
==11692==    by 0x680DD9D: proto_tree_print_node (print.c:169)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DE8B: proto_tree_print_node (print.c:218)
==11692==    by 0x68114E9: proto_tree_children_foreach (proto.c:656)
==11692==    by 0x680DCFD: proto_tree_print (print.c:132)
==11692==    by 0x4143C9: print_packet (tshark.c:4129)
==11692==    by 0x413971: process_packet (tshark.c:3739)
==11692==    by 0x410E3E: main (tshark.c:3481)
==11692== 
==11692== Syscall param write(buf) points to uninitialised byte(s)
==11692==    at 0xC5D5870: __write_nocancel (syscall-template.S:81)
==11692==    by 0xC563002: _IO_file_write@@GLIBC_2.2.5 (fileops.c:1261)
==11692==    by 0xC5644DB: _IO_do_write@@GLIBC_2.2.5 (fileops.c:538)
==11692==    by 0xC5636A0: _IO_file_xsputn@@GLIBC_2.2.5 (fileops.c:1332)
==11692==    by 0xC5587C3: fputs (iofputs.c:40)
==11692==    by 0x68106FF: print_line_text (print_stream.c:131)
==11692==    by 0x680F373: print_hex_data_buffer (print.c:1003)
==11692==    by 0x680F089: print_hex_data (print.c:903)
==11692==    by 0x41443A: print_packet (tshark.c:4152)
==11692==    by 0x413971: process_packet (tshark.c:3739)
==11692==    by 0x410E3E: main (tshark.c:3481)
==11692==  Address 0x402744b is not stack'd, malloc'd or (recently) free'd
==11692== 
==11692== 
==11692== HEAP SUMMARY:
==11692==     in use at exit: 1,185,297 bytes in 32,459 blocks
==11692==   total heap usage: 855,146 allocs, 822,687 frees, 76,417,659 bytes
allocated
==11692== 
==11692== LEAK SUMMARY:
==11692==    definitely lost: 3,986 bytes in 166 blocks
==11692==    indirectly lost: 36,496 bytes in 51 blocks
==11692==      possibly lost: 0 bytes in 0 blocks
==11692==    still reachable: 1,144,815 bytes in 32,242 blocks
==11692==         suppressed: 0 bytes in 0 blocks
==11692== Rerun with --leak-check=full to see details of leaked memory
==11692== 
==11692== For counts of detected and suppressed errors, rerun with: -v
==11692== Use --track-origins=yes to see where uninitialised values come from
==11692== ERROR SUMMARY: 11 errors from 7 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.