## Summary When Wireshark decodes an AMR-NB audio stream in bandwidth-efficient mode (RFC 4867 §4.3) and the RTP payload contains a frame encoded in mode 7 (AMR 12.2 kbps), the function codec_amr_decode() writes one byte past the end of a 32-byte stack buffer named aligned. The written byte is derived from attacker-controlled packet data. An attacker who can arrange for a victim to open a crafted PCAP file and play its RTP stream can use this primitive to corrupt adjacent stack variables, potentially leading to arbitrary code execution. ## AI assistance Yes, for analysis after crash found. ## Sample capture file [amrnb_oob.pcap](/uploads/de596e021cfa2e5d5c39e37420b170f3/amrnb_oob.pcap) ## Steps to reproduce 1. Load the pcap with wireshark 2. Go to menu `Telephony` -> VoIP Calls 3. Click on the stream and then `Play Streams` -> Wireshark crashes ## What is the current bug behavior? Wireshark crashes immediatly. ``` Triggered by Thread: 0, Dispatch Queue: com.apple.main-thread Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Termination Reason: Namespace SIGNAL, Code 6, Abort trap: 6 Terminating Process: Wireshark [52670] Application Specific Information: stack buffer overflow Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_kernel.dylib 0x18b6695b0 __pthread_kill + 8 1 libsystem_pthread.dylib 0x18b6a3888 pthread_kill + 296 2 libsystem_c.dylib 0x18b5a88e0 __abort + 132 3 libsystem_c.dylib 0x18b59926c __stack_chk_fail + 96 4 amrnb.so 0x1104a7e9c codec_amr_decode + 1092 5 Wireshark 0x102814298 decode_rtp_packet_payload + 144 6 Wireshark 0x102541cec RtpAudioStream::decodeAudio(QAudioDevice) + 548 7 Wireshark 0x102541a78 RtpAudioStream::decode(QAudioDevice) + 92 8 Wireshark 0x10254ca14 RtpPlayerDialog::rescanPackets(bool) + 784 9 Wireshark 0x10254bf70 RtpPlayerDialog::retapPackets() + 932 10 QtCore 0x105700b50 QObject::event(QEvent*) + 672 11 QtWidgets 0x104507944 QWidget::event(QEvent*) + 3156 12 QtWidgets 0x1044b9570 QApplicationPrivate::notify_helper(QObject*, QEvent*) + 332 13 QtWidgets 0x1044bafcc QApplication::notify(QObject*, QEvent*) + 3208 14 QtCore 0x1056b787c QCoreApplication::sendEvent(QObject*, QEvent*) + 172 15 QtCore 0x1056b80fc QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) + 524 16 libqcocoa.dylib 0x105e742f8 0x105e5c000 + 99064 17 libqcocoa.dylib 0x105e75598 0x105e5c000 + 103832 18 CoreFoundation 0x18b742a08 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28 19 CoreFoundation 0x18b74299c __CFRunLoopDoSource0 + 172 20 CoreFoundation 0x18b742708 __CFRunLoopDoSources0 + 232 21 CoreFoundation 0x18b741398 __CFRunLoopRun + 820 22 CoreFoundation 0x18b7fbf3c _CFRunLoopRunSpecificWithOptions + 532 23 HIToolbox 0x1982ac790 RunCurrentEventLoopInMode + 316 24 HIToolbox 0x1982afab8 ReceiveNextEventCommon + 488 25 HIToolbox 0x198439b64 _BlockUntilNextEventMatchingListInMode + 48 26 AppKit 0x19005e014 _DPSBlockUntilNextEventMatchingListInMode + 236 27 AppKit 0x18fb5be48 _DPSNextEvent + 588 28 AppKit 0x190622f08 -[NSApplication(NSEventRouting) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 688 29 AppKit 0x190622c14 -[NSApplication(NSEventRouting) nextEventMatchingMask:untilDate:inMode:dequeue:] + 72 30 AppKit 0x18fb54780 -[NSApplication run] + 368 31 libqcocoa.dylib 0x105e72e1c 0x105e5c000 + 93724 32 QtCore 0x1056c0f40 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) + 588 33 QtCore 0x1056b758c QCoreApplication::exec() + 228 34 Wireshark 0x1024d9c40 main + 3980 35 dyld 0x18b2d9d54 start + 7184 ``` ## What is the expected correct behavior? Wireshark running the RTP stream ## Build information ``` Version 4.6.4 (v4.6.4-0-g93282876538d). Compile-time info: Bit width: 64-bit Compiler: Clang 14.0.3 (clang-1403.0.22.14.1) GLib: 2.86.3 With: +automatic updates +nghttp2 1.65.0 +brotli +nghttp3 1.9.0 +Gcrypt 1.11.2 +PCRE2 10.45 2025-02-05 +GnuTLS 3.8.12 and PKCS#11 +Qt 6.9.3 +Kerberos (MIT) +QtMultimedia +libpcap +Snappy 1.2.2 +libsmi 0.4.8 +Sparkle +libxml2 2.15.1 +xxhash 0.8.3 +Lua 5.4.7 +zlib 1.2.11 +LZ4 1.10.0 +zlib-ng 2.2.4 +MaxMind +Zstandard 1.5.7 +Minizip-ng 4.0.10 Without: -POSIX capabilities Runtime info: OS: macOS 26.3.1, build 25D2128 (Darwin 25.3.0) CPU: Apple M4 Memory: 36864 MB of physical memory GLib: 2.86.3 Locale: LC_TYPE=en_GB.UTF-8 Plugins: supported, 23 loaded With: +brotli 1.2.0 +libsmi 0.4.8 +Qt 6.9.3 +c-ares 1.34.6 +LZ4 1.10.0 +xxhash 803 +dark display mode +nghttp2 1.65.0 +zlib 1.2.12 +Gcrypt 1.11.2 +nghttp3 1.9.0 +Zstandard 1.5.7 +GnuTLS 3.8.12 +PCRE2 10.45 2025-02-05 +libpcap 1.10.1 +QPA plugin "cocoa" Without: -HiDPI ```