Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 13254] New: Buildbot crash output: fuzz-2016-12-17-782.pcap

[bugzilla-daemon@xxxxxxxxxxxxx]

Bug ID	13254
Summary	Buildbot crash output: fuzz-2016-12-17-782.pcap
Product	Wireshark
Version	unspecified
Hardware	x86-64
URL	https://www.wireshark.org/download/automated/captures/fuzz-2016-12-17-782.pcap
OS	Ubuntu
Status	CONFIRMED
Severity	Major
Priority	High
Component	Dissection engine (libwireshark)
Assignee	bugzilla-admin@wireshark.org
Reporter	buildbot-do-not-reply@wireshark.org

Problems have been found with the following capture file:

https://www.wireshark.org/download/automated/captures/fuzz-2016-12-17-782.pcap

stderr:
Input file:
/home/wireshark/menagerie/menagerie/14807-160719-04_BLE_sensor_and_CGW_prefix_added_exp_pdu.pcapng

Build host information:
Linux wsbb04 4.4.0-53-generic #74-Ubuntu SMP Fri Dec 2 15:59:10 UTC 2016 x86_64
x86_64 x86_64 GNU/Linux
Distributor ID:    Ubuntu
Description:    Ubuntu 16.04.1 LTS
Release:    16.04
Codename:    xenial

Buildbot information:
BUILDBOT_REPOSITORY=ssh://wireshark-buildbot@code.wireshark.org:29418/wireshark
BUILDBOT_WORKERNAME=clang-code-analysis
BUILDBOT_BUILDNUMBER=3825
BUILDBOT_URL=http://buildbot.wireshark.org/wireshark-master/
BUILDBOT_BUILDERNAME=Clang Code Analysis
BUILDBOT_GOT_REVISION=da5cad4d68c72996d97a9923df9205cbf633e55e

Return value:  0

Dissector bug:  0

Valgrind error count:  84



Git commit
commit da5cad4d68c72996d97a9923df9205cbf633e55e
Author: Pascal Quantin <pascal.quantin@gmail.com>
Date:   Fri Dec 16 23:33:49 2016 +0100

    ULP: use unit strings

    Change-Id: Id6cca5fa5b7547a43488e0bd83bb150ef008f48e
    Reviewed-on: https://code.wireshark.org/review/19309
    Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
    Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
    Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
    Reviewed-by: Michael Mann <mmann78@netscape.net>


==10583== Memcheck, a memory error detector
==10583== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==10583== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==10583== Command:
/home/wireshark/builders/wireshark-master-fuzz/clangcodeanalysis/install.plain/bin/tshark
-nr /fuzz/buildbot/clangcodeanalysis/valgrind-fuzz/fuzz-2016-12-17-782.pcap
==10583== 

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet 10:
packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet 14:
packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet 16:
packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet 20:
packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"
==10583== Conditional jump or move depends on uninitialised value(s)
==10583==    at 0x4C33D52: __memcmp_sse4_1 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10583==    by 0x69E1D13: addresses_equal (address.h:230)
==10583==    by 0x69E1D13: fragment_addresses_equal (reassemble.c:82)
==10583==    by 0xA6FEDCE: g_hash_table_lookup_extended (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==10583==    by 0x69E3216: lookup_fd_head (reassemble.c:541)
==10583==    by 0x69E3216: fragment_add_seq_common (reassemble.c:1886)
==10583==    by 0x69E3817: fragment_add_seq_check_work (reassemble.c:2037)
==10583==    by 0x69E38D9: fragment_add_seq_next (reassemble.c:2100)
==10583==    by 0x6B4A1EC: dissect_btle (packet-btle.c:944)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583==    by 0x6F7EFDB: dissect_nordic_ble (packet-nordic_ble.c:313)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583== 
==10583== Conditional jump or move depends on uninitialised value(s)
==10583==    at 0x4C33D52: __memcmp_sse4_1 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10583==    by 0x69E1D4D: addresses_equal (address.h:230)
==10583==    by 0x69E1D4D: fragment_addresses_equal (reassemble.c:83)
==10583==    by 0xA6FEDCE: g_hash_table_lookup_extended (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==10583==    by 0x69E3216: lookup_fd_head (reassemble.c:541)
==10583==    by 0x69E3216: fragment_add_seq_common (reassemble.c:1886)
==10583==    by 0x69E3817: fragment_add_seq_check_work (reassemble.c:2037)
==10583==    by 0x69E38D9: fragment_add_seq_next (reassemble.c:2100)
==10583==    by 0x6B4A1EC: dissect_btle (packet-btle.c:944)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583==    by 0x6F7EFDB: dissect_nordic_ble (packet-nordic_ble.c:313)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583== 

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet 65:
packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"
==10583== Conditional jump or move depends on uninitialised value(s)
==10583==    at 0x4C33D52: __memcmp_sse4_1 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10583==    by 0x69E1D13: addresses_equal (address.h:230)
==10583==    by 0x69E1D13: fragment_addresses_equal (reassemble.c:82)
==10583==    by 0xA6FE5F9: ??? (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==10583==    by 0x69E3834: fragment_unhash (reassemble.c:789)
==10583==    by 0x69E3834: fragment_add_seq_check_work (reassemble.c:2052)
==10583==    by 0x69E38D9: fragment_add_seq_next (reassemble.c:2100)
==10583==    by 0x6B4A769: dissect_btle (packet-btle.c:883)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583==    by 0x6F7EFDB: dissect_nordic_ble (packet-nordic_ble.c:313)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583==    by 0x6CAA1E2: dissect_exported_pdu (packet-exported_pdu.c:285)
==10583== 
==10583== Conditional jump or move depends on uninitialised value(s)
==10583==    at 0x4C33D52: __memcmp_sse4_1 (in
/usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==10583==    by 0x69E1D4D: addresses_equal (address.h:230)
==10583==    by 0x69E1D4D: fragment_addresses_equal (reassemble.c:83)
==10583==    by 0xA6FE5F9: ??? (in
/lib/x86_64-linux-gnu/libglib-2.0.so.0.4800.1)
==10583==    by 0x69E3834: fragment_unhash (reassemble.c:789)
==10583==    by 0x69E3834: fragment_add_seq_check_work (reassemble.c:2052)
==10583==    by 0x69E38D9: fragment_add_seq_next (reassemble.c:2100)
==10583==    by 0x6B4A769: dissect_btle (packet-btle.c:883)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583==    by 0x6F7EFDB: dissect_nordic_ble (packet-nordic_ble.c:313)
==10583==    by 0x69B8695: call_dissector_through_handle (packet.c:650)
==10583==    by 0x69B8695: call_dissector_work (packet.c:725)
==10583==    by 0x69B774C: call_dissector_only (packet.c:2954)
==10583==    by 0x69B774C: call_dissector_with_data (packet.c:2967)
==10583==    by 0x6CAA1E2: dissect_exported_pdu (packet-exported_pdu.c:285)
==10583== 

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
100: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
111: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
126: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
128: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
170: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
204: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
208: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
213: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
243: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
262: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
275: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
357: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
373: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
418: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
419: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
430: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
435: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
445: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
472: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
485: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
487: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
491: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
492: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
545: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
571: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
578: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
653: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
657: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
667: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
696: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
733: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
740: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
779: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
789: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
795: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
803: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
845: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
852: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
857: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
858: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
871: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
890: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"

** (process:10583): WARNING **: Dissector bug, protocol BT LE LL, in packet
898: packet-btle.c:840: failed assertion "btle_frame_info != ((void*)0)"
==10583== 
==10583== HEAP SUMMARY:
==10583==     in use at exit: 6,088,364 bytes in 9,754 blocks
==10583==   total heap usage: 285,661 allocs, 275,907 frees, 37,937,240 bytes
allocated
==10583== 
==10583== LEAK SUMMARY:
==10583==    definitely lost: 1,380 bytes in 87 blocks
==10583==    indirectly lost: 0 bytes in 0 blocks
==10583==      possibly lost: 0 bytes in 0 blocks
==10583==    still reachable: 6,086,984 bytes in 9,667 blocks
==10583==         suppressed: 0 bytes in 0 blocks
==10583== Rerun with --leak-check=full to see details of leaked memory
==10583== 
==10583== For counts of detected and suppressed errors, rerun with: -v
==10583== Use --track-origins=yes to see where uninitialised values come from
==10583== ERROR SUMMARY: 84 errors from 4 contexts (suppressed: 0 from 0)

[ no debug trace ]

---

      You are receiving this mail because:

• You are watching all bug changes.