wireshark crashes when analyzing RTP streams

Bug #1333658 reported by Tais P. Hansen
10
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Wireshark
Unknown
Unknown
wireshark (Ubuntu)
Confirmed
Undecided
Unassigned

Bug Description

When I choose Telephony -> RTP -> Show All Streams, select two steams and click Analyze, wireshark crashes with the error below.

A similar issue seems to exist here: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=9132

I'm unable to share the trace in question as it contains customer data. The trace is TZSP encapsulated which may make a difference.

**
ERROR:address_to_str.c:627:address_to_str_buf: code should not be reached
Program received signal SIGABRT, Aborted.
0x00007ffff0f26f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.

(gdb) bt full
#0 0x00007ffff0f26f79 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        resultvar = 0
        pid = 31980
        selftid = 31980
#1 0x00007ffff0f2a388 in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x7ffff58384a3, sa_sigaction = 0x7ffff58384a3}, sa_mask = {__val = {140737488273776, 140737250304928, 140737351947607, 140733193388037, 0, 72057594037927936, 140737235610920, 69568688, 140737250304928, 74, 140737351976213, 0, 0, 140737239512968, 4294967295, 0}}, sa_flags = 0, sa_restorer = 0x42588b0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007ffff1a60175 in g_assertion_message () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#3 0x00007ffff1a6020a in g_assertion_message_expr () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#4 0x00007ffff4dc851d in address_to_str_buf (addr=0x4127800, buf=0x7fffdf601000 "\302\202\220\220", <incomplete sequence \343>, buf_len=256) at address_to_str.c:627
        ddp_addr = {net = 12, node = 0 '\000'}
        ieee_802_15_4_short_addr = <optimized out>
        temp = "\377\377\377\377\000\000\000\000\000\001\000\000\000\000\000\000\000x\022\004\000\000\000\000*\200\334\365\377\177\000"
        addrdata = <optimized out>
        tempptr = <optimized out>
        buf_len = 256
        buf = 0x7fffdf601000 "\302\202\220\220", <incomplete sequence \343>
        addr = 0x4127800
#5 0x00007ffff4dc8946 in ep_address_to_str (addr=addr@entry=0x4127800) at address_to_str.c:521
        str = 0x7fffdf601000 "\302\202\220\220", <incomplete sequence \343>
#6 0x00007ffff4dc6e85 in get_addr_name (addr=0x4127800) at addr_resolv.c:2995
No locals.
#7 0x00000000004af104 in rtpstream_view_selection_func (selection=<optimized out>, model=<optimized out>, path=<optimized out>, path_currently_selected=<optimized out>, userdata=<optimized out>) at rtp_stream_dlg.c:636
        iter = {stamp = -1111188923, user_data = 0x40da230, user_data2 = 0x0, user_data3 = 0x0}
        nb_selected = <optimized out>
        selected_stream = 0x4127800
        result = 1
        label_text = " A\206\000\000\000\000\000\rr\245\361\377\177\000\000\266]\027\363\377\177\000\000R\v\000\000\000\000\000\000\320I\025\004\000\000\000\000\301٧\361\377\177\000\000\020Z\025\004", '\000'
<repeats 12 times>, "`]\030\004\000\000\000\000\365X\245\361\377\177\000"
#8 0x00007ffff301c3c2 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#9 0x00007ffff301c442 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#10 0x00007ffff301ce0e in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#11 0x00007ffff303107c in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#12 0x00007ffff3032f53 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#13 0x00007ffff1f0f3b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#14 0x00007ffff1f20d3d in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#15 0x00007ffff1f28a29 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#16 0x00007ffff1f28ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#17 0x00007ffff2f1ae35 in gtk_list_store_remove () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#18 0x00007ffff2f1b567 in gtk_list_store_clear () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#19 0x00000000004afa3a in rtpstream_dlg_update (list_lcl=0x41ee580) at rtp_stream_dlg.c:1078
No locals.
#20 0x00007ffff4e0668e in draw_tap_listeners (draw_all=draw_all@entry=0) at tap.c:348
        tl = 0x40ca9c0
#21 0x0000000000446f3b in tap_update_cb (data=<optimized out>) at main.c:1292
No locals.
#22 0x00007ffff1a3c703 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#23 0x00007ffff1a3bce5 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#24 0x00007ffff1a3c048 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#25 0x00007ffff1a3c0ec in g_main_context_iteration () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#26 0x00007ffff2f1e085 in gtk_main_iteration () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#27 0x000000000046a555 in update_progress_dlg (dlg=dlg@entry=0x423aa50, percentage=percentage@entry=0.0499701388, status=status@entry=0x7ffffffeca20 "7530 of 150690 packets") at progress_dlg.c:398
        dlg_w = 0x2236710
        prog_bar = 0x41e0b10
        time_now = {tv_sec = 1403609894, tv_usec = 384388}
        delta_time = 240535
        ul_left = <optimized out>
        ul_elapsed = 0
        ul_percentage = 4
        tmp = "00:00\000Recalculating statistics on: all packets\000\000&Ҷ\365\377\177", '\000' <repeats 18 times>, "\377\377\377\377", '\000' <repeats 20 times>, "@\236T\002"
#28 0x0000000000434468 in process_specified_packets (cf=cf@entry=0x821960 <cfile>, range=range@entry=0x7fffffffcbc0, string1=string1@entry=0x52dd80 "Recalculating statistics on", string2=string2@entry=0x57f525 "all packets", callback=callback@entry=0x430e00 <retap_packet>, callback_args=callback_args@entry=0x7fffffffcbb0, terminate_is_stop=1) at file.c:2222
        framenum = 7531
        fdata = 0x26e4800
        pd = "\000#T\234b1\000\fB\322\362P\b\000E\000\000\367\000\000@\000\070\021\337\aWt?&\300\250\v\254\202\302\220\220\000\343/\023\001\000\000\001\001\000PX \006\250\000\fB\303\355\005\b\000E\000\000\310\000\000@\000<\021zT\262\025\370\027\300\250X\373\361\006*\330\000\264\225ˀ\b\000\021\000\000\064\200\035\335t\321", '\325' <repeats 25 times>, "UU\325UUUUU\325\325\325\325UUUUU\325\325\325\325\325UU\325\325\325UU\325\325UUUUUUU\325\325\325\325\325UUUUUUUUU\325\325U\325\325\325UUUU\325\325UU\325\325\325\325\325\325U\325\325UU"...
        ret = PSP_FINISHED
        progbar = 0x423aa50
        progbar_count = 7530
        progbar_val = 0.0499701388
        progbar_stop_flag = 0
        progbar_start_time = {tv_sec = 1403609894, tv_usec = 143853}
        progbar_status_str = "7530 of 150690 packets\000\000\200\311\376\377\377\177\000\000\300Ж\000\000\000\000\000P\311\376\377\377\177\000\000\300і\000\000\000\000\000 \311\376\377\377\177\000\000\260D\234\000\000\000\000\000\360\310\376\377\377\177\000\000@Җ\000\000\000\000\000i\265\242\361\377\177\000\000\340\313\376\377"
        progbar_nextstep = 7530
        progbar_quantum = 1506
        process_this = <optimized out>
        phdr = {presence_flags = 0, ts = {secs = 0, nsecs = 0}, caplen = 261, len = 261, pkt_encap = 1, interface_id = 0, opt_comment = 0x0, drop_count = 0, pack_flags = 0, pseudo_header = {eth = {fcs_len = -1}, x25 = {flags = 255 '\377'}, isdn = {uton = -1, channel = 0 '\000'}, atm = {flags = 4294967295, aal = 0 '\000', type = 0 '\000', subtype = 0 '\000', vpi = 0, vci = 0, aal2_cid = 0 '\000', channel = 0, cells = 0, aal5t_u2u = 0, aal5t_len = 0, aal5t_chksum = 0}, ascend = {type = 65535, user = "\377\377", '\000' <repeats 61 times>, sess = 0, call_num = '\000' <repeats 63 times>, chunk = 0, task = 0}, p2p = {sent
= -1}, ieee_802_11 = {fcs_len = -1, decrypted = 0, channel = 0 '\000', data_rate = 0, signal_level = 0 '\000'}, cosine = {encap = 255 '\377', direction = 255 '\377', if_name = "\377\377", '\000' <repeats 125
times>, pro = 0, off = 0, pri = 0, rm = 0, err = 0}, irda = {pkttype = 65535}, nettl = {subsys = 65535, devid = 0, kind = 0, pid = 0, uid = 0}, mtp2 = {sent = 255 '\377', annex_a_used = 255 '\377', link_number = 65535}, k12 = {input = 4294967295, input_name = 0x0, stack_file = 0x0, input_type = 0, input_info = {atm = {vp = 0, vc = 0, cid = 0}, ds0mask = 0}, extra_info = 0x0, extra_length = 0, stuff = 0x0}, lapd = {pkttype = 65535, we_network = 255 '\377'}, dct2000 = {inner_pseudo_header = {isdn = {uton = -1, channel = 0 '\000'}, atm = {flags = 4294967295, aal = 0 '\000', type = 0 '\000', subtype = 0 '\000', vpi = 0,
vci = 0, aal2_cid = 0 '\000', channel = 0, cells = 0, aal5t_u2u = 0, aal5t_len = 0, aal5t_chksum = 0}, p2p = {sent = -1}}, seek_off = 0, wth = 0x0}, erf = {phdr = {ts = 4294967295, type = 0 '\000', flags = 0
'\000', rlen = 0, lctr = 0, wlen = 0}, ehdr_list = {{ehdr = 0}, {ehdr = 0}, {ehdr = 0}, {ehdr = 0}, {ehdr = 0}, {ehdr = 0}, {ehdr = 0}, {ehdr = 0}}, subhdr = {eth_hdr = 0, mc_hdr = 0}}, sita = {sita_flags = 255 '\377', sita_signals = 255 '\377', sita_errors1 = 255 '\377', sita_errors2 = 255 '\377', sita_proto = 0 '\000'}, bthci = {sent = -1, channel = 0 '\000'}, l1event = {uton = -1}, i2c = {is_event = 255 '\377', bus = 255 '\377', flags = 0}, gsm_um = {uplink = -1, channel = 0 '\000', bsic = 0 '\000', arfcn = 0, tdma_frame = 0, error = 0 '\000', timeshift = 0}, nstr = {rec_offset = 4294967295, rec_len = 0, nicno_offset = 0 '\000', nicno_len = 0 '\000', dir_offset = 0 '\000', dir_len = 0 '\000', eth_offset = 0 '\000', pcb_offset = 0 '\000', l_pcb_offset = 0 '\000', rec_type = 0 '\000', vlantag_offset = 0 '\000', coreid_offset = 0 '\000', srcnodeid_offset = 0 '\000', destnodeid_offset = 0 '\000', clflags_offset = 0 '\000', src_vmname_len_offset = 0 '\000', dst_vmname_len_offset = 0 '\000', data_offset = 0 '\000'}, nokia = {eth = {fcs_len = -1}, stuff = "\000\000\000"}, llcp = {adapter = 255 '\377', flags = 255 '\377'}}}
#29 0x000000000043467a in cf_retap_packets (cf=0x821960 <cfile>) at file.c:2320
        range = {process = range_process_all, process_filtered = 0, remove_ignored = 0, include_dependents = 0, user_range = 0x4229140, user_range_status = CVT_NO_ERROR, selected_packet = 1, cf = 0x821960 <cfile>, mark_range_cnt = 0, user_range_cnt = 0, ignored_cnt = 0, ignored_marked_cnt = 0, ignored_mark_range_cnt = 0, ignored_user_range_cnt = 0, displayed_cnt = 150690, displayed_plus_dependents_cnt = 150690, displayed_marked_cnt = 0, displayed_mark_range_cnt = 0, displayed_user_range_cnt = 0, displayed_ignored_cnt = 0, displayed_ignored_marked_cnt = 0, displayed_ignored_mark_range_cnt = 0, displayed_ignored_user_range_cnt = 0, marked_range_active = 0, marked_range_left = 0, selected_done = 0}
        callback_args = {construct_protocol_tree = 0, cinfo = 0x0}
        filtering_tap_listeners = 0
        tap_flags = <optimized out>
        __FUNCTION__ = "cf_retap_packets"
#30 0x00000000004ac67a in on_refresh_bt_clicked (bt=<optimized out>, user_data=0x7fffa2366010) at rtp_analysis.c:2047
        bt = <optimized out>
        user_data = 0x7fffa2366010
        error_string = 0x0
#31 0x00000000004adf0e in rtp_analysis (src_fwd=src_fwd@entry=0x7fffffffcd00, port_src_fwd=port_src_fwd@entry=60808, dst_fwd=dst_fwd@entry=0x7fffffffcd20, port_dst_fwd=port_dst_fwd@entry=10970, ssrc_fwd=ssrc_fwd@entry=4043312546, src_rev=src_rev@entry=0x7fffffffcd40, port_src_rev=port_src_rev@entry=10970, dst_rev=dst_rev@entry=0x7fffffffcd60, port_dst_rev=60808, ssrc_rev=4043313043) at rtp_analysis.c:3899
        user_data = 0x7fffa2366010
        fd = 16
        i = <optimized out>
        col = {{pixel = 0, red = 0, green = 0, blue = 0}, {pixel = 0, red = 65535, green = 0, blue = 0}, {pixel = 0, red = 0, green = 65535, blue = 0}, {pixel = 0, red = 56797, green = 52428, blue = 26214}, {pixel = 0, red = 26214, green = 52428, blue = 56797}, {pixel = 0, red = 0, green = 0, blue = 65535}}
        rgba_col = {{red = 0, green = 0, blue = 0, alpha = 1}, {red = 1, green = 0, blue = 0.10000000000000001, alpha = 1}, {red = 0, green = 1, blue = 0, alpha = 1}, {red = 0.86699999999999999, green = 0.80000000000000004, blue = 0.40000000000000002, alpha = 1}, {red = 0.40000000000000002, green = 0.80000000000000004, blue = 0.86699999999999999, alpha = 1}, {red = 0, green = 0, blue = 1, alpha = 1}}
        tempname = 0x41b8f10 "/tmp/wireshark_rtp_r_20140624133814_y60WoM"
#32 0x00000000004aebf8 in rtpstream_on_analyse (button=<optimized out>, user_data=<optimized out>) at rtp_stream_dlg.c:539
        src_fwd = {type = AT_IPv4, hf = -1, len = 4, data = 0x41b4a10}
        port_src_fwd = 60808
        dst_fwd = {type = AT_IPv4, hf = -1, len = 4, data = 0x4143070}
        port_dst_fwd = 10970
        ssrc_fwd = 4043312546
        src_rev = {type = AT_IPv4, hf = -1, len = 4, data = 0x41c0280}
        port_src_rev = 10970
        dst_rev = {type = AT_IPv4, hf = -1, len = 4, data = 0x4185270}
        port_dst_rev = <optimized out>
        ssrc_rev = <optimized out>
#33 0x00007ffff1f0f5e7 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#34 0x00007ffff1f28088 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#35 0x00007ffff1f28ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#36 0x00007ffff2e54808 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#37 0x00007ffff1f0f3b8 in g_closure_invoke () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#38 0x00007ffff1f20557 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#39 0x00007ffff1f28a29 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#40 0x00007ffff1f28ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#41 0x00007ffff2e536c1 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#42 0x00007ffff2f1eefe in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#43 0x00007ffff1f0f5e7 in ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#44 0x00007ffff1f28088 in g_signal_emit_valist () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#45 0x00007ffff1f28ce2 in g_signal_emit () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
No symbol table info available.
#46 0x00007ffff3047df4 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#47 0x00007ffff2f1d24c in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#48 0x00007ffff2f1eada in gtk_main_do_event () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#49 0x00007ffff2b22c22 in ?? () from /usr/lib/x86_64-linux-gnu/libgdk-3.so.0
No symbol table info available.
#50 0x00007ffff1a3be04 in g_main_context_dispatch () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#51 0x00007ffff1a3c048 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#52 0x00007ffff1a3c30a in g_main_loop_run () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
No symbol table info available.
#53 0x00007ffff2f1dfe5 in gtk_main () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
No symbol table info available.
#54 0x000000000042199f in main (argc=0, argv=0x7fffffffdc10) at main.c:3193
        init_progfile_dir_error = <optimized out>
        s = <optimized out>
        opt = <optimized out>
        arg_error = <optimized out>
        filter = <optimized out>
        rf_path = 0x0
        rf_open_errno = 32767
        gdp_path = 0x0
        dp_path = 0x0
        err = -134225464
        start_capture = 0
        list_link_layer_types = <optimized out>
        if_list = <optimized out>
        err_str = 0xb1fc60 "@k\230"
        rc_file = <optimized out>
        cf_name = <optimized out>
        rfilter = 0x0
        dfilter = 0x0
        jfilter = <optimized out>
        rfcode = 0x0
        rfilter_parse_failed = <optimized out>
        prefs_p = <optimized out>
        badopt = <optimized out>
        splash_win = <optimized out>
        log_flags = 255
        go_to_packet = 0
        jump_backwards = SD_FORWARD
        jump_to_filter = 0x0
        optind_initial = <optimized out>
        status = <optimized out>
        optstring = "a:b:B:c:C:Df:g:Hhi:IjJ:kK:lLm:nN:o:P:pr:R:Ss:t:u:vw:X:y:Y:z:"
        __FUNCTION__ = "main"
---
ApportVersion: 2.14.1-0ubuntu3.2
Architecture: amd64
CurrentDesktop: Unity
DistroRelease: Ubuntu 14.04
EcryptfsInUse: Yes
InstallationDate: Installed on 2010-09-14 (1378 days ago)
InstallationMedia: Kubuntu 10.04.1 LTS "Lucid Lynx" - Release amd64 (20100816.2)
NonfreeKernelModules: nvidia
Package: wireshark 1.10.6-1
PackageArchitecture: amd64
ProcVersionSignature: Ubuntu 3.13.0-30.54-generic 3.13.11.2
Tags: trusty
Uname: Linux 3.13.0-30-generic x86_64
UpgradeStatus: Upgraded to trusty on 2014-05-21 (33 days ago)
UserGroups: adm admin cdrom dialout kvm libvirtd lpadmin plugdev sambashare wireshark
_MarkForUpload: True

Revision history for this message
Tais P. Hansen (taisph) wrote : Dependencies.txt

apport information

tags: added: apport-collected trusty
description: updated
Revision history for this message
Tais P. Hansen (taisph) wrote : ProcEnviron.txt

apport information

Tais P. Hansen (taisph)
summary: - wireshark crashes when analyzing RTP steams
+ wireshark crashes when analyzing RTP streams
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in wireshark (Ubuntu):
status: New → Confirmed
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.