Multiple "failed assertion "saved_layers_len < 500"" messages for protobuf protocol

asked 2023-10-12 09:15:55 +0000

Cookie_with_jam gravatar image

updated 2023-10-12 10:01:28 +0000

Hello! I have a problem with multiple errors like

[Epan WARNING] – Dissector bug, protocol ProtoBuf, in packet 1706090: C:\My_folders\Develop\wireshark\epan\packet.c:876: failed assertion "saved_layers_len < 500"

I have an upstream protocol and underlying protocol Protobuf and during parsing Protobuf for big *.pcap files I met this error. In my case some packet has ~550 layers. I can't send the *.pcap file.

Is there any way to avoid this error without increase limit in Wireshark source code? Because I use dll plugin and can't add workaround in a source code there.

edit retag flag offensive close merge delete

Comments

I found that changing 'repeated fixed32' to 'bytes' fields for big messages helps. But why do we need such restriction for 500 layers? I see that my question about this limitation is not the first.

Cookie_with_jam gravatar imageCookie_with_jam ( 2023-10-12 10:00:22 +0000 )edit

The check was added in Add dissection recursion checks. to address Issue 15778: Buildbot crash output: fuzz-2019-05-11-20211.pcap.

Here a change was made to a dissector to solve the issue:
18130: Dissector bug, protocol HTTP failed assertion "saved_layers_len < 500" with chunked/multipart

Can you share a capture file and .proto file(s) that produce the error?
Perhaps there is work to be done other than just raising the threshold in epan/packet.c:

#define PINFO_LAYER_MAX_RECURSION_DEPTH 500
Chuckc gravatar imageChuckc ( 2023-10-12 23:26:47 +0000 )edit