It's possible to create a FrameInformation object that's not backed by
any frame data. In this case, fi_ is NULL and loadFrameTree() does not
run a dissection. However, we run epan_dissect_cleanup() unconditionally
in the destructor, even if edt_ is uninitialized. This causes a crash
when wireshark is closed.
Convert edt_ into a pointer. Run the cleanup only if we ran the
dissection before.
The issue can be reproduced by applying a display filter that makes the
list of the packets smaller than the packet list window. Right click
onto an "empty" part of the packet list and select "Mark/Unmark Frame".
Exiting wireshark at this point causes a segmentation fault
Thread 1 "wireshark" received signal SIGSEGV, Segmentation fault.
tvb_free_chain (tvb=0xf000e000d000c) at ../epan/tvbuff.c:124
124 tvb_free_internal(tvb);
(gdb) bt
#0 tvb_free_chain (tvb=0xf000e000d000c) at ../epan/tvbuff.c:124
#1 0x00007ffff430491e in epan_dissect_cleanup (edt=0x555558075b48) at ../epan/epan.c:648
#2 0x00005555558fa5a6 in FrameInformation::~FrameInformation (this=0x555558075b20,
__in_chrg=<optimized out>) at ../ui/qt/utils/frame_information.cpp:57
#3 0x00005555558fa5e9 in FrameInformation::~FrameInformation (this=0x555558075b20,
__in_chrg=<optimized out>) at ../ui/qt/utils/frame_information.cpp:55
...
#12 0x00005555559a74f7 in PacketList::~PacketList (this=0x55555602e930,
__in_chrg=<optimized out>) at /usr/include/x86_64-linux-gnu/qt5/QtCore/qstring.h:1130
Change-Id: I347dd4901b4e08c37008ff25ac1f20a67555d9fd
Reviewed-on: https://code.wireshark.org/review/36825
Reviewed-by: Martin Kaiser <wireshark@kaiser.cx>
Petri-Dish: Martin Kaiser <wireshark@kaiser.cx>
Tested-by: Petri Dish Buildbot
Reviewed-by: Anders Broman <a.broman58@gmail.com>
759fb119a7