This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Why does call_dissector() cause an Access Violation?

0

In my c++ project,use call_dissector() to decode the s1ap data, in most time, it works fine. but if the s1ap contains NAS info, the exception "Access Violation" occurs. code:

epan_dissect_t *edtt....(initials)
dissector_handle_t handle = find_dissector("s1ap");
call_dissector(handle, edtt->tvb, &edtt->pi, edtt->tree);

the sample s1ap data(hex)

000b405c00000300000005c0065077e100080003400260001a00454427478345a50607623b09013801010891683108200545f2002b6013a1015618939153768974f200084170902171242314050003d90202006b00610064006500610049006f

Anyone can help me? Thanks.

asked 24 May '16, 20:05

garport's gravatar image

garport
6●1●1●3
accept rate: 0%

edited 26 May '16, 02:47

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

It would be helpful if you were indicating us which Wireshark version you are using, and if the S1AP PDU was complete (when I try to decode the one posted above it appears to be truncated: the ASN.1 PER string indicates that the NAS PDU should be 68 bytes long but only 4 bytes are present).

(25 May '16, 02:45) Pascal Quantin

version: Wireshark 2.0.2 64bit Sorry about the sample data: two '0x' mixed in The sample data is only the s1ap pdu message and NOT include any headers. Thanks for help.

(25 May '16, 17:55) garport

When you say "my c++ project" do you mean a C++ addition to Wireshark, or an external project using libwireshark?

(26 May '16, 02:35) grahamb ♦

an external project using libwireshark

(26 May '16, 17:38) garport

One Answer:

0

Decoding this PDU with standard Wireshark 2.0.2 64 bits on Windows does not trigger any exception.

As you seem to call libwireshark from your own source code, the best way to move forward is probably to investigate this yourself with a debugger. The Windows debugging symbols (assuming you are using Windows) can be found here.

answered 26 May '16, 04:37

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k●10●60
accept rate: 30%