Created attachment 16142 [details]
capture file

Build Information:
TShark (Wireshark) 2.5.1 (v2.5.1rc0-182-gaef93dba)

Copyright 1998-2018 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) without libpcap, with GLib 2.42.2, with zlib 1.2.8, without
SMI, without c-ares, without Lua, without GnuTLS, with Gcrypt 1.6.3, without
Kerberos, without GeoIP, without nghttp2, without LZ4, without Snappy, without
libxml2.

Running on Linux 3.17.4-301.fc21.x86_64, with Intel(R) Xeon(R) CPU          
E5530  @ 2.40GHz (with SSE4.2), with 24093 MB of physical memory, with locale
pl_PL.UTF-8, with Gcrypt 1.6.3, with zlib 1.2.8.

Built using gcc 4.9.2 20150212 (Red Hat 4.9.2-6).

--
oss-fuzz during fuzzing found a crash in nbap dissector (https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=5914)

It can be attached with tshark -V using attached capture file

Top backtrace:

(gdb) bt
#0  0x00007ffff4b42cb9 in dissect_nbap_TransportFormatSet_NrOfTransportBlocks (tvb=<optimized out>, offset=48, actx=0x7fffffffb9b0, tree=<optimized out>, hf_index=<optimized out>) at ./asn1/Nbap/nbap.cnf:1363
#1  0x00007ffff4735846 in dissect_per_sequence (tvb=tvb@entry=0x7fffe40cbcf0, offset=30, offset@entry=27, actx=actx@entry=0x7fffffffb9b0, parent_tree=parent_tree@entry=0x7fffe8a5faf0, hf_index=hf_index@entry=98249, 
    ett_index=<optimized out>, sequence=0x7ffff64f3b40 <TransportFormatSet_DynamicPartList_item_sequence>) at packet-per.c:1908
#2  0x00007ffff4b42691 in dissect_nbap_TransportFormatSet_DynamicPartList_item (tvb=0x7fffe40cbcf0, offset=27, actx=0x7fffffffb9b0, tree=0x7fffe8a5faf0, hf_index=98249) at ./asn1/Nbap/nbap.cnf:1344
#3  0x00007ffff4731a44 in dissect_per_sequence_of_helper (tvb=tvb@entry=0x7fffe40cbcf0, offset=offset@entry=27, actx=actx@entry=0x7fffffffb9b0, tree=tree@entry=0x7fffe8a5f940, 
    func=0x7ffff4b42640 <dissect_nbap_TransportFormatSet_DynamicPartList_item>, hf_index=98249, length=2) at packet-per.c:564
#4  0x00007ffff4734320 in dissect_per_constrained_sequence_of (tvb=tvb@entry=0x7fffe40cbcf0, offset=27, offset@entry=22, actx=actx@entry=0x7fffffffb9b0, parent_tree=parent_tree@entry=0x7fffe8a5f480, hf_index=hf_index@entry=98247, 
    ett_index=23345, seq=0x7ffff64f3af0 <TransportFormatSet_DynamicPartList_sequence_of>, min_len=1, max_len=32, has_extension=0) at packet-per.c:939
#5  0x00007ffff4b436e6 in dissect_nbap_TransportFormatSet_DynamicPartList (tvb=0x7fffe40cbcf0, offset=22, actx=0x7fffffffb9b0, tree=0x7fffe8a5f480, hf_index=98247) at ./asn1/Nbap/nbap.cnf:1340
#6  0x00007ffff4735846 in dissect_per_sequence (tvb=0x7fffe40cbcf0, offset=22, actx=0x7fffffffb9b0, parent_tree=<optimized out>, hf_index=<optimized out>, ett_index=<optimized out>, sequence=0x7ffff64f3740 <TransportFormatSet_sequence>)
    at packet-per.c:1908