## Summary **File**: `epan/dissectors/packet-http.c` **Function**: `dissect_http_tcp()` The X.25 dissector establishes a conversation that routes subsequent packets through the HTTP dissector via `try_conversation_dissector_by_id()`. If we look at `epan/dissectors/packet-http.c` the HTTP dissector's `dissect_http_tcp()` accesses `tcpinfo->flags` around line 4509: ```c end_of_stream = (tcpinfo && IS_TH_FIN(tcpinfo->flags)); ``` When called via the X.25 conversation path (not TCP), the `data` parameter isn't a valid `tcpinfo` struct as it points to stale/uninitialized stack memory, causing a 2-byte read past the stack buffer boundary. ## Steps to reproduce Run the following pcap: `tshark -r poc_http_crash.pcapng -o ip.defragment:FALSE -n` [poc_http_crash.pcapng](/uploads/52582fa1bac108a1b97bd494626bb0f9/poc_http_crash.pcapng) ## Relevant logs and/or screenshots ``` ==50816==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x00016f72060c at pc 0x00012207a7a0 bp 0x00016f720190 sp 0x00016f720188 READ of size 2 at 0x00016f72060c thread T0 #0 0x00012207a79c in dissect_http_tcp packet-http.c:4509 #1 0x000123820204 in call_dissector_through_handle packet.c:945 #2 0x000123815e60 in call_dissector_work packet.c:1036 #3 0x0001237e5c9c in try_conversation_dissector_by_id conversation.c:2942 #4 0x000122c57fb4 in dissect_x25_common packet-x25.c:1933 #5 0x000122c56c18 in dissect_x25 packet-x25.c:2022 #6 0x000123820204 in call_dissector_through_handle packet.c:945 #7 0x000123815e60 in call_dissector_work packet.c:1036 #8 0x000123816394 in dissector_try_uint packet.c:1790 #9 0x0001222c85bc in dissect_llc packet-llc.c #10 0x000123820204 in call_dissector_through_handle packet.c:945 #11 0x000123815e60 in call_dissector_work packet.c:1036 #12 0x00012381cf38 in call_dissector packet.c:3716 #13 0x000122121f58 in dissect_ieee80211_pv0 packet-ieee80211.c #14 0x00012211b9c0 in dissect_ieee80211_common packet-ieee80211.c:42109 #15 0x0001220f4980 in dissect_ieee80211 packet-ieee80211.c:42143 #16 0x000123820204 in call_dissector_through_handle packet.c:945 #17 0x000123815e60 in call_dissector_work packet.c:1036 #18 0x000123813060 in call_dissector_with_data packet.c:3701 #19 0x000123820204 in call_dissector_through_handle packet.c:945 #20 0x000123815e60 in call_dissector_work packet.c:1036 #21 0x000123813060 in call_dissector_with_data packet.c:3701 #22 0x0001226337fc in dissect_ppi packet-ppi.c:1184 #23 0x000123820204 in call_dissector_through_handle packet.c:945 #24 0x000123815e60 in call_dissector_work packet.c:1036 #25 0x000121f1f5d8 in dissect_frame packet-frame.c:1066 #26 0x000123820204 in call_dissector_through_handle packet.c:945 #27 0x000123815e60 in call_dissector_work packet.c:1036 #28 0x0001238127a0 in dissect_record packet.c:746 #29 0x0001237f4948 in epan_dissect_run_with_taps epan.c:748 #30 0x0001006ec398 in process_packet_single_pass tshark.c:4546 #31 0x0001006e8ed4 in process_cap_file tshark.c:4313 #32 0x0001006e3894 in main tshark.c:2635 #33 0x0001843b5d50 (<unknown module>) Address 0x00016f72060c is located in stack of thread T0 at offset 76 in frame #0 0x000122c56e24 in dissect_x25_common packet-x25.c:1207 This frame has 4 object(s): [32, 40) 'ti' (line 1209) [64, 65) 'q_bit_set' (line 1220) [80, 88) 'hdtbl_entry' (line 1225) <== Memory access at offset 76 underflows this variable [112, 120) 'frag_tree_item' (line 1870) HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork (longjmp and C++ exceptions *are* supported) SUMMARY: AddressSanitizer: stack-buffer-overflow packet-http.c:4509 in dissect_http_tcp Shadow bytes around the buggy address: 0x00016f720380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720480: f1 f1 f1 f1 f8 f8 f8 f8 f8 f8 f8 f8 f3 f3 f3 f3 0x00016f720500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720580: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 =>0x00016f720600: 01[f2]00 f2 f2 f2 f8 f3 f3 f3 f3 f3 00 00 00 00 0x00016f720680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x00016f720880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==50816==ABORTING [1] 50816 abort -o ip.defragment:FALSE -o tcp.desegment_tcp_streams:FALSE -n -r ``` ## Build information ``` TShark (Wireshark) 4.7.0 (v4.7.0rc0-2479-g58f04df371f3). Copyright 1998-2026 Gerald Combs <gerald@wireshark.org> and contributors. Licensed under the terms of the GNU General Public License (version 2 or later). This is free software; see the file named COPYING in the distribution. There is NO WARRANTY; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compile-time info: Bit width: 64-bit Compiler: Clang 17.0.0 (clang-1700.6.4.2) GLib: 2.88.0 With: +brotli +LZ4 1.10.0 +Gcrypt 1.12.1 +MaxMind +GnuTLS 3.8.12 and PKCS#11 +nghttp2 1.68.1 +Kerberos (MIT) +nghttp3 1.15.0 +libpcap +PCRE2 10.47 2025-10-21 +libsmi 0.5.0 +zlib 1.2.12 +libxml2 2.9.13 +Zstandard 1.5.7 +Lua 5.5.0 Without: -POSIX capabilities -xxhash -Snappy -zlib-ng Runtime info: OS: macOS 26.3.1, build 25D2128 (Darwin 25.3.0) CPU: Apple M1 Max Memory: 32768 MB of physical memory GLib: 2.88.0 Locale: LC_TYPE=en_US.UTF-8 Plugins: supported, 0 loaded With: +brotli 1.2.0 +libpcap 1.10.1 +nghttp3 1.15.0 +c-ares 1.34.6 +libsmi 0.5.0 +PCRE2 10.47 2025-10-21 +Gcrypt 1.12.1 +LZ4 1.10.0 +zlib 1.2.12 +GnuTLS 3.8.12 +nghttp2 1.68.1 +Zstandard 1.5.7 ```