Crash when displaying several times INFO column

This issue was migrated from bug 10755 in our old bug tracker.

Original bug information:

Reporter: Mark Faenza
Status: RESOLVED FIXED
Product: Wireshark
Component: Dissection engine (libwireshark)
OS: All
Platform: All
Version: 1.12.2

Attachments:

: Wireshark Error
am1slc02-mgmt-DCA-igb0-1417714259.snoop.gz: trace
: wireshark icon
Wireshark.old.rar: wireshark.old

Mark Faenza said:

Created attachment 13308 Wireshark Error

Build Information: Version 1.12.2 (v1.12.2-0-g898fa22a from master-1.12)

Copyright 1998-2014 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.23, with Cairo 1.10.2, with Pango 1.34.0, with GLib 2.38.0, with WinPcap (4_1_3), with libz 1.2.5, with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.2, without Python, with GnuTLS 3.2.15, with Gcrypt 1.6.2, without Kerberos, with GeoIP, with PortAudio V19-devel (built Nov 12 2014), with AirPcap.

Running on 64-bit Windows 7 Service Pack 1, build 7601, with WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), GnuTLS 3.2.15, Gcrypt 1.6.2, without AirPcap. Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz, with 8126MB of physical memory.

Built using Microsoft Visual C++ 10.0 build 40219

Wireshark is Open Source Software released under the GNU General Public License.

Check the man page and http://www.wireshark.org for more information.

Hi

recently when i try to open a new trace in wireshark i get the error that i am attaching.

I am transferring the trace to my local machine and then i try to open it with wireshark but i get an error

can someone please explain how can i solve this?

mark

added crash libwireshark version1.12 labels

Pascal Quantin said:

Hi Mark,

could you attach the snoop file so that we can review what's wrong? Or if it is too big, upload it somewhere.

Thanks in advance, Pascal.

Mark Faenza said:

hi pascal

i can attach it but the problem is that this happens for every snoop file that i try to open and this was not happening previously

shall i still attach it?

mark

Pascal Quantin said:

Yes please: I opened a few snoop files from previous bug reports and they did not crash for me.

Thanks, Pascal.

Mark Faenza said:

Created attachment 13309 trace

Mark Faenza said:

hi pascal

i attached the trace.

as i advised earlier its happening for all traces not this one only

thanks mark

Pascal Quantin said:

I can open it without any issue using Wireshark 1.12.2 x64. Your crash could be related to your user profile (either linked to an option you set, or to a corrupted parameter or a custom plugin being installed). Does it work if you temporarily remove the folder %‍APPDATA%\Wireshark (this is where your personal settings are being stored) ?

Mark Faenza said:

Created attachment 13310 wireshark icon

Mark Faenza said:

can you please confirm if i have to remove the wireshark in the attachment i just attached?

mark

Pascal Quantin said:

(In reply to Mark Faenza from comment #8)  
> can you please confirm if i have to remove the wireshark in the attachment i  
> just attached?  
>  
> mark  

Not at all. I'm not asking you to remove the wireshark.exe program, but to go to the %APPDATA% folder (just type %APPDATA% in the address bar of the file explorer and press enter) and rename the Wireshark folder to Wirehsark.old (for example) and relaunch Wireshark to create a new profile folder.
Alternatively, you can uninstall Wireshark and check the "Personal Settings box" you you are asked which components should be removed. Then reinstall Wireshark.

Mark Faenza said:

ok understood

i just did it and the trace now opens successfully :)


wow man this is great :)

does that mean all is solved?

:)

Pascal Quantin said:

(In reply to Mark Faenza from comment #10)  
> ok understood  
>  
> i just did it and the trace now opens successfully :)  
>  
>  
> wow man this is great :)  
>  
> does that mean all is solved?  
>  
> :)  

It means that you have something wrong in your old preferences. Either an option activated that triggers a Wireshark bug, or a file corrupted, or...
If you still have you old profile folder, it could be interesting to upload it here so that someone can have a look.

Mark Faenza said:

Created attachment 13311 wireshark.old

Mark Faenza said:

sure

i just submitted it :)

thanks again

Pascal Quantin said:

The crash comes form the custom columns defined in your older profile:

# Packet list hidden columns
# List all columns to hide in the packet list.
gui.column.hidden: %Cus:diameter.CC-Total-Octets:0:R,%Cus:diameter.CC-Total-Octets:0:R,%Cus:diameter.CC-Total-Octets:0:R,%Cus:diameter.CC-Total-Octets:0:R,%Cus:diameter.CC-Total-Octets:0:R,%Cus:diameter.CC-Total-Octets:0:R,%Cus:CC-Request-Type:0:R,%Cus:diameter.CC-Total-Octets:0:R

# Packet list column format
# Each pair of strings consists of a column title and its format
gui.column.format:
	"Termination-Cause", "%i",
	"CC-Total-Octets", "%Cus:diameter.CC-Total-Octets:0:R",
	"CC-Total-Octets", "%Cus:diameter.CC-Total-Octets:0:R",
	"CC-Total-Octets", "%Cus:diameter.CC-Total-Octets:0:R",
	"New Column", "%Cus:diameter.CC-Request-Type:0:R",
	"Host", "%Cus:http.host:0:R",
	"Time", "%Aut",
	"Source", "%s",
	"Destination", "%d",
	"Protocol", "%p",
	"New Column", "%Cus:diameter.CC-Total-Octets:0:R",
	"CC-Total-Octets", "%Cus:diameter.CC-Total-Octets:0:R",
	"CC-Total-Octets", "%Cus:diameter.CC-Total-Octets:0:R",
	"CC-Total-Octets", "%Cus:CC-Request-Type:0:R",
	"CC-Total-Octets", "%Cus:diameter.CC-Total-Octets:0:R",
	"Response Time", "%Cus:diameter.resp_time:0:R",
	"iMSI", "%Cus:camel.iMSI:0:R",
	"Subscription-Id-Data", "%i",
	"New Column", "%i"

Several columns were set to "Information" type, leading to a crash.

Mark Faenza said:

wow pascal

makes sense as that is the last thing i was playing with

great stuff thanks man

Guy Harris said:

(In reply to Pascal Quantin from comment #‍14)
> Several columns were set to "Information" type

I.e., several columns have "%‍i"?

Pascal Quantin said:

(In reply to Guy Harris from comment #‍16)
> (In reply to Pascal Quantin from comment #‍14)
> > Several columns were set to "Information" type
>
> I.e., several columns have "%‍i"?

Yes that's what I meant.

Gerrit Code Review said:

Change 5630 had a related patch set uploaded by Guy Harris: Fix varargs handling in col_{add,append}_lstr().

https://code.wireshark.org/review/5630