From 1b50a326fb5b8126bf701f4208d80648809612fe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Stig=20Bj=C3=B8rlykke?= Date: Fri, 20 Nov 2015 19:39:55 +0100 Subject: epan: Free pointers to deallocated memory MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When redissecting packets we call epan_free() which deallocates wmem_file_scope memory. Such memory may be used in proto_data for the currently selected packet (cf->edt) and leaves pointers to deallocated memory (cf->edt->pi.fd->pfd). Free them after epan_free() to avoid unintended usage in packet_list_clear(). Bug: 11740 Change-Id: Ia3bc54f3f34e644a98b8a7eb1addd19b8aeeaab9 Reviewed-on: https://code.wireshark.org/review/11996 Petri-Dish: Stig Bjørlykke Tested-by: Petri Dish Buildbot Reviewed-by: Anders Broman (cherry picked from commit 391f11a7ec16045ed5909d617edcaada1f8f9afc) Reviewed-on: https://code.wireshark.org/review/12053 --- file.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/file.c b/file.c index 85bca90fbc..2f6ab3fce3 100644 --- a/file.c +++ b/file.c @@ -1632,6 +1632,12 @@ rescan_packets(capture_file *cf, const char *action, const char *action_item, gb /* 'reset' dissection session */ epan_free(cf->epan); + if (cf->edt && cf->edt->pi.fd) { + /* All pointers in "per frame proto data" for the currently selected + packet are allocated in wmem_file_scope() and deallocated in epan_free(). + Free them here to avoid unintended usage in packet_list_clear(). */ + frame_data_destroy(cf->edt->pi.fd); + } cf->epan = ws_epan_new(cf); cf->cinfo.epan = cf->epan; -- cgit v1.2.1