Error when opening snoop from Juniper SSG-140

This issue was migrated from bug 5762 in our old bug tracker.

Original bug information:

Reporter: sla…@‍gma…
Status: RESOLVED FIXED
Product: Wireshark
Component: GTK+ UI
OS: Linux
Platform: x86-64
Version: 1.4.4

Attachments:

snoop-no-detail.txt: Snoop output file when snoop detail was off
snoop-96bytes-detail.txt: Snoop output file with snoop detail set to 96 bytes

sla…@‍gma… said:

Build Information: #‍wireshark 1.4.4

Copyright 1998-2011 Gerald Combs <gerald@‍wireshark.org> and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GTK+ 2.24.3, with GLib 2.28.3, with libpcap 1.1.1, with libz 1.2.5, with POSIX capabilities (Linux), without libpcre, without SMI, without c-ares, without ADNS, without Lua, without Python, with GnuTLS 2.10.5, with Gcrypt 1.4.6, without Kerberos, without GeoIP, without PortAudio, without AirPcap.

Running on Linux 2.6.37.3, with libpcap version 1.1.1, with libz 1.2.5, GnuTLS 2.10.5, Gcrypt 1.4.6.

Built using gcc 4.5.2.

Overview:
Wireshark crashed when opening a snoop capture file from a Juniper SSG-140.

Steps to reproduce:
wireshark snoop.pcap

Actual results:
**
ERROR:new_packet_list.c:1126:show_cell_data_func: assertion failed: (cell_text)
Aborted
Exits back to prompt.

Expected results:
Wireshark opens snoop file without crashing.

Build data and platform:
Slackware64-current (03/17/2001)
Other build info listed in "Build Information" section.

Additional Info:
Firewall info:
(M)-> get sys
Product Name: SSG-140
Hardware Version: 1010(0)-(00), FPGA checksum: 00000000, VLAN1 IP (0.0.0.0)
Software Version: 6.2.0r4.0, Type: Firewall+VPN

Snoop created with:
clear db
snoop
<capture traffic>
ESC
get db str > tftp server:snoop.pcap

added oslinux uigtk version1.4 labels

sla…@‍gma… said:

Sorry, the command I used is "wireshark -r snoop.pcap".

Sake said:

Could you please provide the snoop output so we can reproduce the issue and write a fix?

(FYI, the output of snoop on the Juniper is a text file which can be parsed by Wireshark and not a libpcap file which your filename suggests)

sla…@‍gma… said:

Found the problem, was not running with 'snoop detail', just 'snoop'.

Guy Harris said:

A low-level assertion failure in the bowels of Wireshark is not an acceptable way of handling an incorrect capture file; perhaps you used the wrong command to capture the data, but there's still a bug in Wireshark if you can hand it a file and it crashes.

Sake said:

(In reply to comment #‍4)
> A low-level assertion failure in the bowels of Wireshark is not an acceptable
> way of handling an incorrect capture file; perhaps you used the wrong command
> to capture the data, but there's still a bug in Wireshark if you can hand it a
> file and it crashes.

I'll have a look at it, I can reproduce the error with a snoop-output file from my own Juniper 5GT when using snoop with no detail.

Sake said:

Fixed in SVN 36232.

Sake said:

Created attachment 6047 Snoop output file when snoop detail was off

For future reference

Sake said:

Created attachment 6049 Snoop output file with snoop detail set to 96 bytes

For future reference

closed