Wireshark-bugs: [Wireshark-bugs] [Bug 12954] New: SMB2 dissector fails on GetInfo Request messag
| Bug ID |
12954
|
| Summary |
SMB2 dissector fails on GetInfo Request messages with an assertion exception
|
| Product |
Wireshark
|
| Version |
Git
|
| Hardware |
x86
|
| OS |
Windows 7
|
| Status |
UNCONFIRMED
|
| Severity |
Normal
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
bugzilla-admin@wireshark.org
|
| Reporter |
paul.offord@advance7.com
|
Build Information:
Build Information:
Version 2.3.0-Syncro (v2.3.0rc0-545-g85b20f7 from unknown)
Copyright 1998-2016 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 5.5.1, with WinPcap (4_1_3), with GLib 2.42.0, with
zlib 1.2.8, with SMI 0.4.8, with c-ares 1.11.0, with Lua 5.2.4, with GnuTLS
3.2.15, with Gcrypt 1.6.2, with MIT Kerberos, with GeoIP, with QtMultimedia,
with AirPcap.
Running on 64-bit Windows 7 Service Pack 1, build 7601, with locale
English_United Kingdom.1252, with WinPcap version 4.1.3 (packet.dll version
4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), with
GnuTLS 3.2.15, with Gcrypt 1.6.2, with AirPcap 4.1.0 build 1622.
Intel(R) Core(TM) i5-5300U CPU @ 2.30GHz (with SSE4.2), with 8082MB of physical
memory.
Built using Microsoft Visual C++ 12.0 build 40629
--
Change 17447 introduces a bug. A change has been made to
dissect_smb2_getinfo_request(). It now returns an integer based on the sum of
two dissected values:
offset = getinfo_offset + getinfo_size;
return offset;
Unfortunately getinfo_offset and getinfo_size are sometimes zero and so a zero
offset is returned. On return to dissect_smb2_command we eventually make this
call:
proto_item_set_len(cmd_item, offset-old_offset);
The calculation of offset-old_offset yields a negative number which is passed
to proto_item_set_len as a length parameter. In proto_item_set_len we have:
DISSECTOR_ASSERT(length >= 0);
Obviously this causes an exception.
You are receiving this mail because:
- You are watching all bug changes.
