Problems have been found with the following capture file: https://www.wireshark.org/download/automated/captures/fuzz-2025-07-26-10818768582.pcap.gz stderr: ``` Branch: master Input file: /var/menagerie/menagerie/merge-request-6030-ssh_dhgex-sha256_aes256-gcm_opensshS.pcapng CI job name: ASan Menagerie Fuzz, ID: 10818768582 CI job URL: https://gitlab.com/wireshark/wireshark/-/jobs/10818768582 Return value: 0 Dissector bug: 0 Date and time: Sat Jul 26 10:15:53 AM UTC 2025 Commits in the last 48 hours: 159d7df1a2bff urlencoded: Add a URL f0a94d2fd61d1 xml: Preload default media types f32916b71915d dtds: Make mscml more compliant XML 351d7761cb75f Geneve: Add support of Cilium (DSR) Frontend Option 97af38ac5bf46 Json2Pcap: updated according to newer Python and jsonraw format a62c4a29ae81f PFCP: Add Juniper dissector support for IEs 32911, 32918, and 32929 b966aa3a588bc Paste only plaintext to Lua console input text field b92fa828d0fe4 xml: register root cdata fields with a .cdata suffix e5f4ff52120dc PLE: Update references to published RFCs d2a0b321cdea2 Qt: Add an application flavor check to the Plot dialog b07500b9006a9 bpv7: Use wmem_map_destroy 4f05d857d76aa wmem: Add a wmem_map_destroy function d3b1ffe878c4b nettrace_3gpp_32_423: Fallback Protocol type when transport is missing e713550f5fd7f nettrace_3gpp_32_423: Add handle of proxy d8977198a5ebe nas-5gs: Dissect N3AN node conf info 7a2d5c3f68992 validate-commit.py: Use CI_API_V4_URL as bug was fixed 32e946dc0fab1 wmem: Add some comments about not using wmem_map with NULL allocator 3ea88a1328c83 RTP: Don't free a wmem_map directly Build host information: Linux 6.8.0-64-generic #67~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Jun 24 15:19:46 UTC 2 x86_64 Distributor ID: Ubuntu Description: Ubuntu 24.04.2 LTS Release: 24.04 Codename: noble Command and args: /builds/wireshark/wireshark/_install/bin/tshark -2 --log-fatal-domains=UTF-8 -nVxr Running as user "root" and group "root". This could be dangerous. AddressSanitizer:DEADLYSIGNAL ================================================================= ==63404==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x797459827bd2 bp 0x7ffdb45847b0 sp 0x7ffdb4584540 T0) ==63404==The signal is caused by a READ memory access. ==63404==Hint: address points to the zero page. #0 0x797459827bd2 in ssh_kex_shared_secret /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:3144:52 #1 0x797459822a53 in ssh_keylog_hash_write_secret /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:2989:22 #2 0x797459836b97 in ssh_dissect_kex_dh_gex /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:1822:13 #3 0x79745983d6ac in ssh_dissect_key_exchange /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:1675:18 #4 0x7974598214e6 in ssh_dissect_ssh2 /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:1250:22 #5 0x79745981dc69 in dissect_ssh /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:1160:26 #6 0x79745b078970 in call_dissector_through_handle /builds/wireshark/wireshark/epan/packet.c:930:9 #7 0x79745b06d880 in call_dissector_work /builds/wireshark/wireshark/epan/packet.c:1021:9 #8 0x79745b07558d in call_dissector_only /builds/wireshark/wireshark/epan/packet.c:3663:8 #9 0x79745b02359d in try_conversation_call_dissector_helper /builds/wireshark/wireshark/epan/conversation.c:2810:11 #10 0x79745b023140 in try_conversation_dissector /builds/wireshark/wireshark/epan/conversation.c:2844:13 #11 0x797459876d34 in decode_tcp_ports /builds/wireshark/wireshark/epan/dissectors/packet-tcp.c:7990:9 #12 0x79745987f77a in process_tcp_payload /builds/wireshark/wireshark/epan/dissectors/packet-tcp.c:8195:13 #13 0x79745987ce13 in desegment_tcp /builds/wireshark/wireshark/epan/dissectors/packet-tcp.c:5117:9 #14 0x797459879189 in dissect_tcp_payload /builds/wireshark/wireshark/epan/dissectors/packet-tcp.c:8268:9 #15 0x79745988d813 in dissect_tcp /builds/wireshark/wireshark/epan/dissectors/packet-tcp.c:9604:17 #16 0x79745b078970 in call_dissector_through_handle /builds/wireshark/wireshark/epan/packet.c:930:9 #17 0x79745b06d880 in call_dissector_work /builds/wireshark/wireshark/epan/packet.c:1021:9 #18 0x79745b06d214 in dissector_try_uint_with_data /builds/wireshark/wireshark/epan/packet.c:1708:8 #19 0x797458bfd3ff in ip_try_dissect /builds/wireshark/wireshark/epan/dissectors/packet-ip.c:1880:7 #20 0x797458c01bf1 in dissect_ip_v4 /builds/wireshark/wireshark/epan/dissectors/packet-ip.c:2471:10 #21 0x79745b078970 in call_dissector_through_handle /builds/wireshark/wireshark/epan/packet.c:930:9 #22 0x79745b06d880 in call_dissector_work /builds/wireshark/wireshark/epan/packet.c:1021:9 #23 0x79745b06d214 in dissector_try_uint_with_data /builds/wireshark/wireshark/epan/packet.c:1708:8 #24 0x79745b06dc56 in dissector_try_uint /builds/wireshark/wireshark/epan/packet.c:1732:9 #25 0x797458802753 in dissect_ethertype /builds/wireshark/wireshark/epan/dissectors/packet-ethertype.c:299:21 #26 0x79745b078970 in call_dissector_through_handle /builds/wireshark/wireshark/epan/packet.c:930:9 #27 0x79745b06d880 in call_dissector_work /builds/wireshark/wireshark/epan/packet.c:1021:9 #28 0x79745b07558d in call_dissector_only /builds/wireshark/wireshark/epan/packet.c:3663:8 #29 0x79745b069a78 in call_dissector_with_data /builds/wireshark/wireshark/epan/packet.c:3676:8 #30 0x797458800777 in dissect_eth_common /builds/wireshark/wireshark/epan/dissectors/packet-eth.c:648:5 #31 0x7974587fec73 in dissect_eth /builds/wireshark/wireshark/epan/dissectors/packet-eth.c:1014:5 #32 0x79745b078970 in call_dissector_through_handle /builds/wireshark/wireshark/epan/packet.c:930:9 #33 0x79745b06d880 in call_dissector_work /builds/wireshark/wireshark/epan/packet.c:1021:9 #34 0x79745b07558d in call_dissector_only /builds/wireshark/wireshark/epan/packet.c:3663:8 #35 0x797458894b8b in dissect_frame /builds/wireshark/wireshark/epan/dissectors/packet-frame.c:1045:6 #36 0x79745b078970 in call_dissector_through_handle /builds/wireshark/wireshark/epan/packet.c:930:9 #37 0x79745b06d880 in call_dissector_work /builds/wireshark/wireshark/epan/packet.c:1021:9 #38 0x79745b07558d in call_dissector_only /builds/wireshark/wireshark/epan/packet.c:3663:8 #39 0x79745b069a78 in call_dissector_with_data /builds/wireshark/wireshark/epan/packet.c:3676:8 #40 0x79745b06912b in dissect_record /builds/wireshark/wireshark/epan/packet.c:731:3 #41 0x79745b0383d4 in epan_dissect_run /builds/wireshark/wireshark/epan/epan.c:662:2 #42 0x5b59cf09acf6 in process_packet_first_pass /builds/wireshark/wireshark/tshark.c:3472:9 #43 0x5b59cf098d38 in process_cap_file_first_pass /builds/wireshark/wireshark/tshark.c:3621:13 #44 0x5b59cf0940e4 in process_cap_file /builds/wireshark/wireshark/tshark.c:4148:29 #45 0x5b59cf08e5a7 in main /builds/wireshark/wireshark/tshark.c:2613:22 #46 0x79744e6a11c9 (/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f) #47 0x79744e6a128a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2a28a) (BuildId: 282c2c16e7b6600b0b22ea0c99010d2795752b5f) #48 0x5b59cef9bcf4 in _start (/builds/wireshark/wireshark/_install/bin/tshark+0x5ecf4) (BuildId: 56c10dfdad1b747a7592f034a8462c18bc1dbc4c) ==63404==Register values: rax = 0x0000000000000000 rbx = 0x00007ffdb4584540 rcx = 0x000075d44a764460 rdx = 0x0000000001000000 rdi = 0x00007ffdb4584480 rsi = 0x0000000000000007 rbp = 0x00007ffdb45847b0 rsp = 0x00007ffdb4584540 r8 = 0x0000000000000001 r9 = 0x00007fffffffff01 r10 = 0x00007fffffffff01 r11 = 0x0000000000000001 r12 = 0x0000000000000005 r13 = 0x0000000000000000 r14 = 0x000000000000000a r15 = 0x0000000000000043 AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV /builds/wireshark/wireshark/epan/dissectors/packet-ssh.c:3144:52 in ssh_kex_shared_secret ==63404==ABORTING fuzz-test.sh stderr: Running as user "root" and group "root". This could be dangerous. ``` *no debug trace*