Some RTP streams make Wireshark crash when trying to play stream
## Summary
I'm in the process of troubleshooting a "sometimes we don't hear the opposite site" issue and therefore are capturing some calls on the firewall interfaces. The Call is with the SIP protocol and states being COMPLETED (INVITE 401 200).
Some of the pcaps containing a phonecall make Wireshark crash. This is on multiple Windows (server or client) systems. Wireshark version v4.0.6-0-gac2fa01286a.
## Sample capture file
Sample PCAP file is added to the bug report.
(You can attach a capture file using the paper clip button in the editor menu bar.
Ensure your capture file does not contain private or sensitive information that cannot
be shared publicly)
## Steps to reproduce
Menu Telephony - VOIP calls - select the call - click Play Streams --> WS crashes after a couple of seconds.
## What is the current bug behavior?
Log Name: Application
Source: Application Error
Date: 26-6-2023 09:28:35
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: MGMT04.domain.local
Description:
Faulting application name: Wireshark.exe, version: 4.0.6.0, time stamp: 0x646e5c1c
Faulting module name: Wireshark.exe, version: 4.0.6.0, time stamp: 0x646e5c1c
Exception code: 0xc0000005
Fault offset: 0x00000000003575cf
Faulting process id: 0x48cc
Faulting application start time: 0x01d9a7ffb3a0d488
Faulting application path: C:\Program Files\Wireshark\Wireshark.exe
Faulting module path: C:\Program Files\Wireshark\Wireshark.exe
Report Id: ad199dee-1867-482e-9664-d4ea6142e96a
Faulting package full name:
Faulting package-relative application ID:
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-06-26T07:28:35.436554100Z" />
<EventRecordID>28329</EventRecordID>
<Channel>Application</Channel>
<Computer>MGMT04.domain.local</Computer>
<Security />
</System>
<EventData>
<Data>Wireshark.exe</Data>
<Data>4.0.6.0</Data>
<Data>646e5c1c</Data>
<Data>Wireshark.exe</Data>
<Data>4.0.6.0</Data>
<Data>646e5c1c</Data>
<Data>c0000005</Data>
<Data>00000000003575cf</Data>
<Data>48cc</Data>
<Data>01d9a7ffb3a0d488</Data>
<Data>C:\Program Files\Wireshark\Wireshark.exe</Data>
<Data>C:\Program Files\Wireshark\Wireshark.exe</Data>
<Data>ad199dee-1867-482e-9664-d4ea6142e96a</Data>
<Data>
</Data>
<Data>
</Data>
</EventData>
</Event>
Log Name: Application
Source: Windows Error Reporting
Date: 26-6-2023 09:28:37
Event ID: 1001
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: MGMT04.domain.local
Description:
Fault bucket 1329355483199741090, type 4
Event Name: APPCRASH
Response: Not available
Cab Id: 0
Problem signature:
P1: Wireshark.exe
P2: 4.0.6.0
P3: 646e5c1c
P4: Wireshark.exe
P5: 4.0.6.0
P6: 646e5c1c
P7: c0000005
P8: 00000000003575cf
P9:
P10:
Attached files:
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA733.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA22.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA52.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA62.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAD0.tmp.txt
These files may be available here:
\\?\C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Wireshark.exe_e48f66b9fcbabd567a371fa22370b562dcf1f54_53d0b2bc_5c9baf03
Analysis symbol:
Rechecking for solution: 0
Report Id: ad199dee-1867-482e-9664-d4ea6142e96a
Report Status: 268435456
Hashed bucket: 363cf681ed4bf24ca272d1c4cc569ca2
Cab Guid: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Windows Error Reporting" />
<EventID Qualifiers="0">1001</EventID>
<Level>4</Level>
<Task>0</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2023-06-26T07:28:37.788042300Z" />
<EventRecordID>28330</EventRecordID>
<Channel>Application</Channel>
<Computer>MGMT04.domain.local</Computer>
<Security />
</System>
<EventData>
<Data>1329355483199741090</Data>
<Data>4</Data>
<Data>APPCRASH</Data>
<Data>Not available</Data>
<Data>0</Data>
<Data>Wireshark.exe</Data>
<Data>4.0.6.0</Data>
<Data>646e5c1c</Data>
<Data>Wireshark.exe</Data>
<Data>4.0.6.0</Data>
<Data>646e5c1c</Data>
<Data>c0000005</Data>
<Data>00000000003575cf</Data>
<Data>
</Data>
<Data>
</Data>
<Data>
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERA733.tmp.dmp
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA22.tmp.WERInternalMetadata.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA52.tmp.xml
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAA62.tmp.csv
\\?\C:\ProgramData\Microsoft\Windows\WER\Temp\WERAAD0.tmp.txt</Data>
<Data>\\?\[Report.wer](/uploads/688f0bb6484e36ffc05142b10a015eb8/Report.wer)AppCrash_Wireshark.exe_e48f66b9fcbabd567a371fa22370b562dcf1f54_53d0b2bc_5c9baf03</Data>
<Data>
</Data>
<Data>0</Data>
<Data>ad199dee-1867-482e-9664-d4ea6142e96a</Data>
<Data>268435456</Data>
<Data>363cf681ed4bf24ca272d1c4cc569ca2</Data>
<Data>0</Data>
</EventData>
</Event>
## What is the expected correct behavior?
RTP audio player with the audio stream for playback.
## Build information
```
Version 4.0.6 (v4.0.6-0-gac2f5a01286a).
Compiled (64-bit) using Microsoft Visual Studio 2022 (VC++ 14.32, build 31332),
with GLib 2.72.3, with PCRE2, with zlib 1.2.12, with Qt 5.15.2, with libpcap,
with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.10.1, with
Kerberos (MIT), with MaxMind, with nghttp2 1.46.0, with brotli, with LZ4, with
Zstandard, with Snappy, with libxml2 2.9.14, with libsmi 0.4.8, with
QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with
SpeexDSP (using bundled resampler), with Minizip, with binary plugins.
Running on 64-bit Windows Server 2019 (1809), build 17763, with Intel(R) Xeon(R)
CPU E5-2640 v3 @ 2.60GHz (with SSE4.2), with 393086 MB of physical memory, with
GLib 2.72.3, with PCRE2 10.40 2022-04-14, with Qt 5.15.2, with Npcap version
1.71, based on libpcap version 1.10.2-PRE-GIT, with c-ares 1.18.1, with GnuTLS
3.6.3, with Gcrypt 1.10.1, with nghttp2 1.46.0, with brotli 1.0.9, with LZ4
1.9.3, with Zstandard 1.5.2, without AirPcap, with light display mode, without
HiDPI, with LC_TYPE=Dutch_Netherlands.utf8, binary plugins supported.
```
issue