Skip to content

Stratoshark: Crash While Sorting on evt.buflen column

Summary

Stratoshark crashes immediately when attempting to sort the event list by the evt.buflen column.

Sample capture file

5_sftp_syscalls.scap

Steps to reproduce

This seems to happen no matter what display filter is applied and no matter what scap file is being used, but I first encountered it with the attached capture file.

  1. Apply the display filter fd.name eq "/home/ubuntu/50MB.zip" and sysdig.event_name eq read and proc.name eq "sftp"
  2. Click the Buffer Length column header to sort by buffer length

What is the current bug behavior?

Immediate application crash

What is the expected correct behavior?

The event list is sorted by that column.

Build information

Version 0.9.1 (ssv0.9.1-0-g0874f1b7c52a).

Compile-time info:
 Bit width: 64-bit
  Compiler: Clang 14.0.3 (clang-1403.0.22.14.1)
      GLib: 2.80.3
 With:
  +automatic updates using Sparkle       +MaxMind
  +brotli                                +Minizip
  +falcosecurity-libs sinsp/scap 0.18.1  +nghttp2 1.62.1
  +Gcrypt 1.10.2                         +nghttp3 1.1.0
  +GnuTLS 3.8.4 and PKCS#11              +PCRE2 10.39 2021-10-29
  +Kerberos (MIT)                        +Qt 6.5.3
  +libpcap                               +QtMultimedia
  +libsmi 0.4.8                          +Snappy 1.2.1
  +libxml2 2.11.9                        +zlib 1.2.11
  +Lua 5.4.6                             +zlib-ng 2.1.6
  +LZ4 1.10.0                            +Zstandard 1.5.6
 Without:
  -POSIX capabilities

Runtime info:
      OS: macOS 15.3.2, build 24D81 (Darwin 24.3.0)
     CPU: Apple M2
  Memory: 16384 MB of physical memory
    GLib: 2.80.3
  Locale: LC_TYPE=UTF-8
 Plugins: supported, 1 loaded
 With:
  +brotli 1.0.9            +libpcap 1.10.1          +nghttp3 1.1.0
  +c-ares 1.31.0           +libsmi 0.4.8            +PCRE2 10.39 2021-10-29
  +Gcrypt 1.10.2           +light display mode      +Qt 6.5.3
  +GnuTLS 3.8.4            +LZ4 1.10.0              +zlib 1.2.12
  +HiDPI                   +nghttp2 1.62.1          +Zstandard 1.5.6

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information