## Summary The DCP-ETSI PFT dissector in Wireshark contains a heap buffer overflow vulnerability in its Reed-Solomon forward error correction (FEC) code path. When a crafted PCAP file containing DCP-ETSI PFT fragments with FEC enabled and RSk=0 is opened, the RS decoder (eras_dec_rs) operates on fixed 255-byte blocks but the output buffer is only allocated to fcount × plen bytes. When fcount × plen < 255, the decoder writes up to 55 bytes past the end of the heap allocation with attacker-controlled data. Note: The DCP-ETSI dissector is registered as a UDP heuristic dissector. Any UDP packet starting with the bytes "PF" (0x5046) and a valid CRC-16 header will be automatically dissected. No specific port configuration is required. The vulnerability triggers during reassembly when the last fragment arrives — simply opening the file is sufficient. ## AI assistance Yes, after Heap Buffer Overflow found. ## Sample capture file [dcp_etsi_heap_overflow.pcap](/uploads/714610b916663d187b3f44e0c6117b4b/dcp_etsi_heap_overflow.pcap) Will trigger with ASAN ## Steps to reproduce Load the pcap with wireshark started with ASAN ## What is the current bug behavior? Heap Over flow ASAN Ouput: ``` Running as user "root" and group "root". This could be dangerous. ** (tshark:1) 12:55:17.145342 [(none) MESSAGE] -- JSON Dictionary: No config.txt or jsonmain.xml found (using generic mode) ================================================================= ==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x50400009779f at pc 0xffff805a5124 bp 0xffffd09796c0 sp 0xffffd0978ea0 WRITE of size 48 at 0x50400009779f thread T0 #0 0xffff805a5120 in memcpy ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 #1 0xffff6d16ddc4 in rs_correct_data /src/epan/dissectors/packet-dcp-etsi.c:264 #2 0xffff6d16e4ec in dissect_pft_fec_detailed /src/epan/dissectors/packet-dcp-etsi.c:382 #3 0xffff6d16e6d0 in dissect_pft_fragmented /src/epan/dissectors/packet-dcp-etsi.c:434 #4 0xffff6d16f14c in dissect_pft /src/epan/dissectors/packet-dcp-etsi.c:532 #5 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #6 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #7 0xffff7003179c in dissector_try_string_with_data /src/epan/packet.c:2075 #8 0xffff6d16da38 in dissect_dcp_etsi /src/epan/dissectors/packet-dcp-etsi.c:149 #9 0xffff6d16dbc0 in dissect_dcp_etsi_heur /src/epan/dissectors/packet-dcp-etsi.c:230 #10 0xffff70036874 in dissector_try_heuristic /src/epan/packet.c:3141 #11 0xffff6e95b4cc in decode_udp_ports /src/epan/dissectors/packet-udp.c:684 #12 0xffff6e960c9c in dissect /src/epan/dissectors/packet-udp.c:1333 #13 0xffff6e960db4 in dissect_udp /src/epan/dissectors/packet-udp.c:1339 #14 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #15 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #16 0xffff700309e4 in dissector_try_uint_with_data /src/epan/packet.c:1766 #17 0xffff6d891b70 in ip_try_dissect /src/epan/dissectors/packet-ip.c:1888 #18 0xffff6d895718 in dissect_ip_v4 /src/epan/dissectors/packet-ip.c:2486 #19 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #20 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #21 0xffff700309e4 in dissector_try_uint_with_data /src/epan/packet.c:1766 #22 0xffff70030a94 in dissector_try_uint /src/epan/packet.c:1790 #23 0xffff6d3dbc38 in dissect_ethertype /src/epan/dissectors/packet-ethertype.c:300 #24 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #25 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #26 0xffff7003884c in call_dissector_only /src/epan/packet.c:3688 #27 0xffff70038898 in call_dissector_with_data /src/epan/packet.c:3701 #28 0xffff6d3d8e38 in dissect_eth_common /src/epan/dissectors/packet-eth.c:651 #29 0xffff6d3da3e8 in dissect_eth /src/epan/dissectors/packet-eth.c:1017 #30 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #31 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #32 0xffff7003884c in call_dissector_only /src/epan/packet.c:3688 #33 0xffff6d487bf8 in dissect_frame /src/epan/dissectors/packet-frame.c:1066 #34 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #35 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #36 0xffff7003884c in call_dissector_only /src/epan/packet.c:3688 #37 0xffff70038898 in call_dissector_with_data /src/epan/packet.c:3701 #38 0xffff7002b374 in dissect_record /src/epan/packet.c:746 #39 0xffff70001c68 in epan_dissect_run_with_taps /src/epan/epan.c:748 #40 0xaaaabbc83560 in process_packet_single_pass /src/tshark.c:4546 #41 0xaaaabbc81264 in process_cap_file_single_pass /src/tshark.c:4095 #42 0xaaaabbc824c8 in process_cap_file /src/tshark.c:4313 #43 0xaaaabbc7b320 in main /src/tshark.c:2635 #44 0xffff61bf84c0 (/lib/aarch64-linux-gnu/libc.so.6+0x284c0) #45 0xffff61bf8594 in __libc_start_main (/lib/aarch64-linux-gnu/libc.so.6+0x28594) #46 0xaaaabbc69fec in _start (/src/build-asan/run/tshark+0x39fec) 0x50400009779f is located 159 bytes after 48-byte region [0x5040000976d0,0x504000097700) allocated by thread T0 here: #0 0xffff805a76d0 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69 #1 0xffff61e3525c in g_malloc (/lib/aarch64-linux-gnu/libglib-2.0.so.0+0x6525c) #2 0xffff61f75c24 in wmem_alloc /src/wsutil/wmem/wmem_core.c:35 #3 0xffff61f7c19c in wmem_simple_alloc /src/wsutil/wmem/wmem_allocator_simple.c:43 #4 0xffff61f75d3c in wmem_alloc /src/wsutil/wmem/wmem_core.c:44 #5 0xffff6d16e490 in dissect_pft_fec_detailed /src/epan/dissectors/packet-dcp-etsi.c:376 #6 0xffff6d16e6d0 in dissect_pft_fragmented /src/epan/dissectors/packet-dcp-etsi.c:434 #7 0xffff6d16f14c in dissect_pft /src/epan/dissectors/packet-dcp-etsi.c:532 #8 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #9 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #10 0xffff7003179c in dissector_try_string_with_data /src/epan/packet.c:2075 #11 0xffff6d16da38 in dissect_dcp_etsi /src/epan/dissectors/packet-dcp-etsi.c:149 #12 0xffff6d16dbc0 in dissect_dcp_etsi_heur /src/epan/dissectors/packet-dcp-etsi.c:230 #13 0xffff70036874 in dissector_try_heuristic /src/epan/packet.c:3141 #14 0xffff6e95b4cc in decode_udp_ports /src/epan/dissectors/packet-udp.c:684 #15 0xffff6e960c9c in dissect /src/epan/dissectors/packet-udp.c:1333 #16 0xffff6e960db4 in dissect_udp /src/epan/dissectors/packet-udp.c:1339 #17 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #18 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #19 0xffff700309e4 in dissector_try_uint_with_data /src/epan/packet.c:1766 #20 0xffff6d891b70 in ip_try_dissect /src/epan/dissectors/packet-ip.c:1888 #21 0xffff6d895718 in dissect_ip_v4 /src/epan/dissectors/packet-ip.c:2486 #22 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #23 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #24 0xffff700309e4 in dissector_try_uint_with_data /src/epan/packet.c:1766 #25 0xffff70030a94 in dissector_try_uint /src/epan/packet.c:1790 #26 0xffff6d3dbc38 in dissect_ethertype /src/epan/dissectors/packet-ethertype.c:300 #27 0xffff7002d21c in call_dissector_through_handle /src/epan/packet.c:945 #28 0xffff7002d920 in call_dissector_work /src/epan/packet.c:1036 #29 0xffff7003884c in call_dissector_only /src/epan/packet.c:3688 SUMMARY: AddressSanitizer: heap-buffer-overflow ../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc:115 in memcpy Shadow bytes around the buggy address: 0x504000097500: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00 0x504000097580: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00 0x504000097600: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00 0x504000097680: fa fa 00 00 00 00 00 00 fa fa 00 00 00 00 00 00 0x504000097700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa =>0x504000097780: fa fa fa[fa]fa fa fa fa fa fa fa fa fa fa fa fa 0x504000097800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x504000097880: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x504000097900: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x504000097980: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x504000097a00: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==1==ABORTING ``` ## What is the expected correct behavior? ## Build information ``` Version 4.6.4 (v4.6.4-0-g93282876538d). Compile-time info: Bit width: 64-bit Compiler: Clang 14.0.3 (clang-1403.0.22.14.1) GLib: 2.86.3 With: +automatic updates +nghttp2 1.65.0 +brotli +nghttp3 1.9.0 +Gcrypt 1.11.2 +PCRE2 10.45 2025-02-05 +GnuTLS 3.8.12 and PKCS#11 +Qt 6.9.3 +Kerberos (MIT) +QtMultimedia +libpcap +Snappy 1.2.2 +libsmi 0.4.8 +Sparkle +libxml2 2.15.1 +xxhash 0.8.3 +Lua 5.4.7 +zlib 1.2.11 +LZ4 1.10.0 +zlib-ng 2.2.4 +MaxMind +Zstandard 1.5.7 +Minizip-ng 4.0.10 Without: -POSIX capabilities Runtime info: OS: macOS 26.3.1, build 25D2128 (Darwin 25.3.0) CPU: Apple M4 Memory: 36864 MB of physical memory GLib: 2.86.3 Locale: LC_TYPE=UTF-8 Plugins: supported, 23 loaded With: +brotli 1.2.0 +light display mode +Qt 6.9.3 +c-ares 1.34.6 +LZ4 1.10.0 +xxhash 803 +Gcrypt 1.11.2 +nghttp2 1.65.0 +zlib 1.2.12 +GnuTLS 3.8.12 +nghttp3 1.9.0 +Zstandard 1.5.7 +libpcap 1.10.1 +PCRE2 10.45 2025-02-05 +libsmi 0.4.8 +QPA plugin "cocoa" Without: -HiDPI ```