Some RTP streams make Wireshark crash when trying to play stream

Summary

I'm in the process of troubleshooting a "sometimes we don't hear the opposite site" issue and therefore are capturing some calls on the firewall interfaces. The Call is with the SIP protocol and states being COMPLETED (INVITE 401 200). Some of the pcaps containing a phonecall make Wireshark crash. This is on multiple Windows (server or client) systems. Wireshark version v4.0.6-0-gac2fa01286a.

Sample capture file

Sample PCAP file is added to the bug report.

(You can attach a capture file using the paper clip button in the editor menu bar. Ensure your capture file does not contain private or sensitive information that cannot be shared publicly)

Steps to reproduce

Menu Telephony - VOIP calls - select the call - click Play Streams --> WS crashes after a couple of seconds.

What is the current bug behavior?

Log Name: Application Source: Application Error Date: 26-6-2023 09:28:35 Event ID: 1000 Task Category: (100) Level: Error Keywords: Classic User: N/A Computer: MGMT04.domain.local Description: Faulting application name: Wireshark.exe, version: 4.0.6.0, time stamp: 0x646e5c1c Faulting module name: Wireshark.exe, version: 4.0.6.0, time stamp: 0x646e5c1c Exception code: 0xc0000005 Fault offset: 0x00000000003575cf Faulting process id: 0x48cc Faulting application start time: 0x01d9a7ffb3a0d488 Faulting application path: C:\Program Files\Wireshark\Wireshark.exe Faulting module path: C:\Program Files\Wireshark\Wireshark.exe Report Id: ad199dee-1867-482e-9664-d4ea6142e96a Faulting package full name: Faulting package-relative application ID: Event Xml: 1000 2 100 0x80000000000000 28329 Application MGMT04.domain.local Wireshark.exe 4.0.6.0 646e5c1c Wireshark.exe 4.0.6.0 646e5c1c c0000005 00000000003575cf 48cc 01d9a7ffb3a0d488 C:\Program Files\Wireshark\Wireshark.exe C:\Program Files\Wireshark\Wireshark.exe ad199dee-1867-482e-9664-d4ea6142e96a

Log Name: Application Source: Windows Error Reporting Date: 26-6-2023 09:28:37 Event ID: 1001 Task Category: None Level: Information Keywords: Classic User: N/A Computer: MGMT04.domain.local Description: Fault bucket 1329355483199741090, type 4 Event Name: APPCRASH Response: Not available Cab Id: 0

Problem signature: P1: Wireshark.exe P2: 4.0.6.0 P3: 646e5c1c P4: Wireshark.exe P5: 4.0.6.0 P6: 646e5c1c P7: c0000005 P8: 00000000003575cf P9: P10:

Attached files: \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA733.tmp.dmp \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA22.tmp.WERInternalMetadata.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA52.tmp.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA62.tmp.csv \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAD0.tmp.txt

These files may be available here: \?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Wireshark.exe_e48f66b9fcbabd567a371fa22370b562dcf1f54_53d0b2bc_5c9baf03

Analysis symbol: Rechecking for solution: 0 Report Id: ad199dee-1867-482e-9664-d4ea6142e96a Report Status: 268435456 Hashed bucket: 363cf681ed4bf24ca272d1c4cc569ca2 Cab Guid: 0 Event Xml: 1001 4 0 0x80000000000000 28330 Application MGMT04.domain.local 1329355483199741090 4 APPCRASH Not available 0 Wireshark.exe 4.0.6.0 646e5c1c Wireshark.exe 4.0.6.0 646e5c1c c0000005 00000000003575cf \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA733.tmp.dmp \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA22.tmp.WERInternalMetadata.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA52.tmp.xml \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA62.tmp.csv \?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAD0.tmp.txt \?Report.werAppCrash_Wireshark.exe_e48f66b9fcbabd567a371fa22370b562dcf1f54_53d0b2bc_5c9baf03 0 ad199dee-1867-482e-9664-d4ea6142e96a 268435456 363cf681ed4bf24ca272d1c4cc569ca2 0

What is the expected correct behavior?

RTP audio player with the audio stream for playback.

Build information

Version 4.0.6 (v4.0.6-0-gac2f5a01286a).

Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.32, build 31332),
with GLib 2.72.3, with PCRE2, with zlib 1.2.12, with Qt 5.15.2, with libpcap,
with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.10.1, with
Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with
Zstandard, with Snappy, with libxml2 2.9.14, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with
SpeexDSP (using bundled resampler), with Minizip, with binary plugins.

Running on 64-bit Windows Server 2019 (1809), build 17763, with Intel(R) Xeon(R)
CPU E5-2640 v3 @ 2.60GHz (with SSE4.2), with 393086 MB of physical memory, with
GLib 2.72.3, with PCRE2 10.40 2022-04-14, with Qt 5.15.2, with Npcap version
1.71, based on libpcap version 1.10.2-PRE-GIT, with c-ares 1.18.1, with GnuTLS
3.6.3, with Gcrypt 1.10.1, with nghttp2 1.46.0, with brotli 1.0.9, with LZ4
1.9.3, with Zstandard 1.5.2, without AirPcap, with light display mode, without
HiDPI, with LC_TYPE=Dutch_Netherlands.utf8, binary plugins supported.