Wireshark-bugs: [Wireshark-bugs] [Bug 13127] New: packet-sdp.c allocates transport_info->encodin
| Bug ID |
13127
|
| Summary |
packet-sdp.c allocates transport_info->encoding_name from wrong memory pool
|
| Product |
Wireshark
|
| Version |
Git
|
| Hardware |
x86
|
| OS |
All
|
| Status |
UNCONFIRMED
|
| Severity |
Minor
|
| Priority |
Low
|
| Component |
Dissection engine (libwireshark)
|
| Assignee |
bugzilla-admin@wireshark.org
|
| Reporter |
j.novak@netsystem.cz
|
Created attachment 15064 [details]
Sample trace to demonstrate the issue
Build Information:
Wireshark 2.3.0 (v2.3.0rc0-1455-gaba4d3a)
Copyright 1998-2016 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later
<http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with Qt 4.8.7, with libpcap, with POSIX capabilities (Linux),
with libnl 3, with GLib 2.46.2, with zlib 1.2.8, with SMI 0.4.8, with c-ares
1.12.0, without Lua, with GnuTLS 3.4.15, with Gcrypt 1.6.6, with MIT Kerberos,
with GeoIP, without nghttp2, without LZ4, without Snappy, with QtMultimedia,
without AirPcap.
Running on Linux 4.7.9-100.fc23.x86_64, with Intel(R) Core(TM) i5-2520M
CPU @ 2.50GHz (with SSE4.2), with 7939 MB of physical memory, with locale
LC_CTYPE=en_US.utf8, LC_NUMERIC=en_US.utf8, LC_TIME=cs_CZ.UTF-8,
LC_COLLATE=en_US.utf8, LC_MONETARY=en_US.utf8, LC_MESSAGES=en_US.utf8,
LC_PAPER=en_US.utf8, LC_NAME=en_US.utf8, LC_ADDRESS=en_US.utf8,
LC_TELEPHONE=en_US.utf8, LC_MEASUREMENT=en_US.utf8,
LC_IDENTIFICATION=en_US.utf8, with libpcap version 1.7.4, with GnuTLS 3.4.15,
with Gcrypt 1.6.6, with zlib 1.2.8.
Built using gcc 5.3.1 20160406 (Red Hat 5.3.1-6).
--
Hello,
during my work with debugging connection related info for SIP calls I found
that time to time call of sdp_dump_transport_info shows wrong encoding names.
Quite often it shown completely nonrelated string from processed SDP header.
I investigated it and found that elements of transport_info->encoding_name
are allocated from wmem_packet_scope() pool. But transport_info is connection
related structure therefore it should survive one packet's life.
As consequence of it, when transport_info is used for second and next packets
during connection, encoding_name points to random place in memory pool which
was freed before and allocated again for different purpose.
I attached file to demonstrate the issue. When you enable DEBUG_CONVERSATION
and process attached file, process of second packet (200 OK) with SDP will show
the issue.
I prepared patch for it. I'm going to commit it with git for review.
Jirka Novak
You are receiving this mail because:
- You are watching all bug changes.
