OSS-Fuzz 393523567: wireshark:fuzzshark_ip_proto-udp: Stack-overflow in fuzzshark_ip_proto-udp

OSS-Fuzz found the following:

==396==ERROR: AddressSanitizer: stack-overflow on address 0x7ffe6c34cff8 (pc 0x0000004d1857 bp 0x00000000001e sp 0x7ffe6c34d000 T0)
SCARINESS: 10 (stack-overflow)
    #0 0x4d1857 in __sanitizer::BufferedStackTrace::UnwindImpl(unsigned long, unsigned long, void*, bool, unsigned int) /src/llvm-project/compiler-rt/lib/asan/asan_stack.cpp:60:7
    #1 0x4c6fa0 in Unwind /src/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_stacktrace.h:130:5
    #2 0x4c6fa0 in __interceptor_malloc /src/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:68:3
    #3 0x311a6e8 in g_malloc
    #4 0x302373d in wmem_simple_alloc wireshark/wsutil/wmem/wmem_allocator_simple.c:43:50
    #5 0x301d3c6 in wmem_alloc wireshark/wsutil/wmem/wmem_core.c:44:12
    #6 0x301d3c6 in wmem_alloc0 wireshark/wsutil/wmem/wmem_core.c:52:11
    #7 0x7b35d7 in wscbor_chunk_read wireshark/epan/wscbor.c:191:29
    #8 0x7b503f in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:369:29
    #9 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #10 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #11 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #12 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #13 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #14 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #15 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #16 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #17 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #18 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #19 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #20 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #21 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #22 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #23 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #24 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #25 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #26 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #27 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #28 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #29 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #30 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #31 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #32 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #33 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #34 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #35 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #36 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #37 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #38 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #39 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #40 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #41 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #42 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #43 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #44 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #45 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #46 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #47 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #48 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #49 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #50 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #51 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #52 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #53 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #54 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #55 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #56 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #57 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #58 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #59 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #60 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #61 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #62 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #63 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #64 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #65 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #66 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #67 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #68 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #69 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #70 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #71 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #72 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #73 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #74 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #75 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #76 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #77 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #78 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #79 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #80 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #81 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #82 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #83 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #84 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #85 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #86 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #87 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #88 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #89 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #90 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #91 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #92 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #93 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #94 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #95 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #96 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #97 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #98 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #99 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #100 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #101 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #102 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #103 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #104 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #105 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #106 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #107 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #108 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #109 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #110 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #111 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #112 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #113 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #114 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #115 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #116 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #117 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #118 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #119 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #120 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #121 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #122 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #123 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #124 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #125 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #126 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #127 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #128 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #129 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #130 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #131 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #132 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #133 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #134 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #135 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #136 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #137 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #138 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #139 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #140 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #141 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #142 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #143 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #144 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #145 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #146 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #147 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #148 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #149 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #150 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #151 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #152 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #153 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #154 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #155 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #156 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #157 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #158 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #159 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #160 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #161 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #162 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #163 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #164 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #165 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #166 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #167 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #168 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #169 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #170 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #171 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #172 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #173 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #174 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #175 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #176 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #177 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #178 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #179 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #180 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #181 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #182 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #183 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #184 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #185 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #186 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #187 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #188 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #189 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #190 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #191 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #192 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #193 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #194 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #195 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #196 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #197 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #198 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #199 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #200 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #201 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #202 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #203 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #204 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #205 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #206 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #207 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #208 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #209 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #210 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #211 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #212 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #213 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #214 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #215 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #216 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #217 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #218 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #219 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #220 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #221 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #222 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #223 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #224 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #225 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #226 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #227 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #228 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #229 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #230 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #231 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #232 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #233 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #234 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #235 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #236 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #237 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #238 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #239 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #240 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #241 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #242 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #243 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #244 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #245 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #246 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #247 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
    #248 0x7b52f0 in wscbor_skip_next_item_internal wireshark/epan/wscbor.c:398:26
SUMMARY: AddressSanitizer: stack-overflow (/mnt/scratch0/clusterfuzz/bot/builds/clusterfuzz-builds-honggfuzz_wireshark_9de6374568df96eba97b9288a3fce517c93d2636/revisions/fuzzshark_ip_proto-udp+0x4d1857)
==396==ABORTING

Reproducer: clusterfuzz-testcase-minimized-fuzzshark_ip_proto-udp-5700125095165952.pcap

added crash libwireshark labels

The issue seems pretty obvious looking at the code, but I'm having trouble replicating this here on macOS and Ubuntu using the reproducer capture.

mentioned in merge request !18957 (merged)

closed with commit 83c73a83

made the issue visible to everyone

I'm still having trouble reproducing this, even when following the instructions at https://google.github.io/oss-fuzz/advanced-topics/reproducing/. If I add

ws_warning("depth: %u offset: %d", depth, *offset);

to the top of wscbor_skip_next_item_internal the depth is never greater than 3, but the offset sometimes goes backward. @BrianSipos do you know if the offset should always advance here?

Yes, well-formed CBOR will always have an encoded size larger than zero so offset should advance by at least one if there is no error. There are some not-well-formed encoded values (see Section 3 of RFC 8949) which could be handled by the wscbor decoder returning an error but explicitly advancing the offset to the point just beyond where the error occurred.

If there is precedent in Wireshark for how to handle these kinds of errors that would be helpful to follow.

After looking a bit, it appears that wscbor_head_read does advance the offset by at least one for each read even if there is an error in well-formed-ness.

mentioned in merge request !19002 (merged)

mentioned in merge request !19003 (merged)

mentioned in commit 73d7d46b

CVE-2025-1492