From Didier Gautheron:

ep memory can't be used for tvbs defined as data_source.
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4054

svn path=/trunk/; revision=30376

13 files changed, 37 insertions, 23 deletions

diff --git a/asn1/spnego/packet-spnego-template.c b/asn1/spnego/packet-spnego-template.c
index d88e58a41e..527d6fcd71 100644
--- a/asn1/spnego/packet-spnego-template.c
+++ b/asn1/spnego/packet-spnego-template.c
@@ -637,6 +637,7 @@ decrypt_gssapi_krb_arcfour_wrap(proto_tree *tree, packet_info *pinfo, tvbuff_t *
 			pinfo->gssapi_decrypted_tvb=tvb_new_child_real_data(tvb, 
 				output_message_buffer,
 				ret, ret);
+			tvb_set_free_cb(pinfo->gssapi_decrypted_tvb, g_free);
 			add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
 			return;
 		}
@@ -705,12 +706,11 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
 		return;
 	}
 
-	rotated = ep_alloc(tvb_length(tvb));
-
-	tvb_memcpy(tvb, rotated, 0, tvb_length(tvb));
+	rotated = tvb_memdup(tvb, 0, tvb_length(tvb));
 	res = rrc_rotate(rotated, tvb_length(tvb), rrc, TRUE);
 
 	next_tvb=tvb_new_child_real_data(tvb, rotated, tvb_length(tvb), tvb_reported_length(tvb));
+	tvb_set_free_cb(next_tvb, g_free);
 	add_new_data_source(pinfo, next_tvb, "GSSAPI CFX");
 
 	output = decrypt_krb5_data(tree, pinfo, usage, next_tvb,
@@ -719,7 +719,7 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
 	if (output) {
 		char *outdata;
 
-		outdata = ep_alloc(tvb_length(tvb));
+		outdata = g_malloc(tvb_length(tvb));
 		memcpy(outdata, output, tvb_length(tvb));
 		g_free(output);
 
@@ -728,6 +728,7 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
 			datalen-16,
 			datalen-16);
 		add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
+		tvb_set_free_cb(pinfo->gssapi_decrypted_tvb, g_free);
 		return;
 	}
 	return;
diff --git a/epan/dissectors/packet-dnp.c b/epan/dissectors/packet-dnp.c
index 230f642be6..1085d84014 100644
--- a/epan/dissectors/packet-dnp.c
+++ b/epan/dissectors/packet-dnp.c
@@ -2468,7 +2468,7 @@ dissect_dnp3_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
     /* XXX - check for dl_len <= 5 */
     data_len = dl_len - 5;
-    tmp = ep_alloc(data_len);
+    tmp = g_malloc(data_len);
     tmp_ptr = tmp;
     i = 0;
     data_offset = 1;  /* skip the transport layer byte when assembling chunks */
@@ -2510,6 +2510,7 @@ dissect_dnp3_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
     if (crc_OK)
     {
       al_tvb = tvb_new_child_real_data(tvb, tmp, (guint) (tmp_ptr-tmp), (gint) (tmp_ptr-tmp));
+      tvb_set_free_cb(al_tvb, g_free);
 
       /* Check for fragmented packet */
       save_fragmented = pinfo->fragmented;
@@ -2586,6 +2587,7 @@ dissect_dnp3_message(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
     {
       /* CRC error - throw away the data. */
       next_tvb = NULL;
+      g_free(tmp);
       proto_tree_add_text(dnp3_tree, tvb, 11, -1, "CRC failed, %u chunks", i);
     }
 
diff --git a/epan/dissectors/packet-icq.c b/epan/dissectors/packet-icq.c
index e24c2f8e8b..de3b5f4b4b 100644
--- a/epan/dissectors/packet-icq.c
+++ b/epan/dissectors/packet-icq.c
@@ -1503,8 +1503,7 @@ dissect_icqv5Client(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
      * bytes in the buffer.
      */
     rounded_size = ((((capturedsize - ICQ5_CL_SESSIONID) + 3)/4)*4) + ICQ5_CL_SESSIONID;
-    decr_pd = g_malloc(rounded_size);
-    tvb_memcpy(tvb, decr_pd, 0, capturedsize);
+    decr_pd = tvb_memdup(tvb, 0, capturedsize);
     decrypt_v5(decr_pd, rounded_size, key);
 
     /* Allocate a new tvbuff, referring to the decrypted data. */
diff --git a/epan/dissectors/packet-iscsi.c b/epan/dissectors/packet-iscsi.c
index cfbd0972f3..ce5d2bcfe3 100644
--- a/epan/dissectors/packet-iscsi.c
+++ b/epan/dissectors/packet-iscsi.c
@@ -1489,7 +1489,7 @@ dissect_iscsi_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint off
 		/* We have a variable length CDB where bytes >16 is transported
 		 * in the AHS.
 		 */
-		cdb_buf=ep_alloc(16+ahs_cdb_length);
+		cdb_buf=g_malloc(16+ahs_cdb_length);
 		/* the 16 first bytes of the cdb */
 		tvb_memcpy(tvb, cdb_buf, cdb_offset, 16);
 		/* the remainder of the cdb from the ahs */
@@ -1498,6 +1498,7 @@ dissect_iscsi_pdu(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, guint off
 		cdb_tvb = tvb_new_child_real_data(tvb, cdb_buf,
 					  ahs_cdb_length+16,
 					  ahs_cdb_length+16);
+                tvb_set_free_cb(cdb_tvb, g_free);
 
 		add_new_data_source(pinfo, cdb_tvb, "CDB+AHS");
 	} else {
diff --git a/epan/dissectors/packet-iwarp-mpa.c b/epan/dissectors/packet-iwarp-mpa.c
index 3d23ff339b..548f68d6e2 100644
--- a/epan/dissectors/packet-iwarp-mpa.c
+++ b/epan/dissectors/packet-iwarp-mpa.c
@@ -330,7 +330,7 @@ remove_markers(tvbuff_t *tvb, packet_info *pinfo, guint32 marker_offset,
 
 	/* allocate memory for the marker-free buffer */
 	mfree_buff_length = orig_length - (MPA_MARKER_LEN * num_markers);
-	mfree_buff = ep_alloc(mfree_buff_length);
+	mfree_buff = malloc(mfree_buff_length);
 	
 	if (!mfree_buff)
 		THROW(OutOfMemoryError);
@@ -346,6 +346,7 @@ remove_markers(tvbuff_t *tvb, packet_info *pinfo, guint32 marker_offset,
 	}
 	mfree_tvb = tvb_new_child_real_data(tvb, mfree_buff, mfree_buff_length,
 			mfree_buff_length);
+	tvb_set_free_cb(mfree_tvb, free);
 	add_new_data_source(pinfo, mfree_tvb, "FPDU without Markers");
 
 	return mfree_tvb;
diff --git a/epan/dissectors/packet-kink.c b/epan/dissectors/packet-kink.c
index 9bdef6179e..ad0f69b980 100644
--- a/epan/dissectors/packet-kink.c
+++ b/epan/dissectors/packet-kink.c
@@ -744,6 +744,7 @@ dissect_payload_kink_encrypt(packet_info *pinfo, tvbuff_t *tvb, int offset, prot
     plaintext=decrypt_krb5_data(tree, pinfo, 0, next_tvb, keytype, NULL);    
     if(plaintext){
       next_tvb=tvb_new_child_real_data(tvb, plaintext, encrypt_length, encrypt_length);
+      tvb_set_free_cb(next_tvb, g_free);
       add_new_data_source(pinfo, next_tvb, "decrypted kink encrypt");
       dissect_decrypt_kink_encrypt(pinfo, next_tvb, tree, encrypt_length);
     }
diff --git a/epan/dissectors/packet-megaco.c b/epan/dissectors/packet-megaco.c
index 3472cd15fe..9d257679d9 100644
--- a/epan/dissectors/packet-megaco.c
+++ b/epan/dissectors/packet-megaco.c
@@ -1734,7 +1734,6 @@ dissect_megaco_h245(tvbuff_t *tvb, packet_info *pinfo, proto_tree *megaco_tree,
 {
 	proto_item *item;
 	proto_tree *tree;
-	guint8 *buf = ep_alloc(10240);
 
 	/*item=proto_tree_add_string(megaco_tree, hf_megaco_h245, tvb,
 		offset, len, msg );
@@ -1748,6 +1747,7 @@ dissect_megaco_h245(tvbuff_t *tvb, packet_info *pinfo, proto_tree *megaco_tree,
 	if(len<20480){
 		int i;
 		tvbuff_t *h245_tvb;
+		guint8 *buf = g_malloc(10240);
 
 		/* first, skip to where the encoded pdu starts, this is
 		   the first hex digit after the '=' char.
@@ -1807,6 +1807,7 @@ dissect_megaco_h245(tvbuff_t *tvb, packet_info *pinfo, proto_tree *megaco_tree,
 			return;
 		}
 		h245_tvb = tvb_new_child_real_data(tvb, buf,i,i);
+		tvb_set_free_cb(h245_tvb, g_free);
 		add_new_data_source(pinfo, h245_tvb, "H.245 over MEGACO");
 		/* should go through a handle, however,  the two h245 entry
 		   points are different, one is over tpkt and the other is raw
@@ -1819,13 +1820,13 @@ dissect_megaco_h245(tvbuff_t *tvb, packet_info *pinfo, proto_tree *megaco_tree,
 static void
 dissect_megaco_h324_h223caprn(tvbuff_t *tvb, packet_info *pinfo, proto_tree *megaco_tree, gint offset _U_, gint len, gchar *msg)
 {
-	guint8 *buf = ep_alloc(10240);
 	asn1_ctx_t actx;
 
 	/* arbitrary maximum length */
 	if(len<20480){
 		int i;
 		tvbuff_t *h245_tvb;
+		guint8 *buf = g_malloc(10240);
 
 		/* first, skip to where the encoded pdu starts, this is
 		   the first hex digit after the '=' char.
@@ -1886,6 +1887,7 @@ dissect_megaco_h324_h223caprn(tvbuff_t *tvb, packet_info *pinfo, proto_tree *meg
 		}
 		h245_tvb = tvb_new_child_real_data(tvb, buf,i,i);
 		add_new_data_source(pinfo, h245_tvb, "H.245 over MEGACO");
+		tvb_set_free_cb(h245_tvb, g_free);
 		/* should go through a handle, however,  the two h245 entry
 		   points are different, one is over tpkt and the other is raw
 		*/
diff --git a/epan/dissectors/packet-per.c b/epan/dissectors/packet-per.c
index 51a11d1c4c..417e0cb8dd 100644
--- a/epan/dissectors/packet-per.c
+++ b/epan/dissectors/packet-per.c
@@ -134,7 +134,7 @@ static tvbuff_t *new_octet_aligned_subset(tvbuff_t *tvb, guint32 offset, asn1_ct
   if (offset & 0x07) {  /* unaligned */
     shift1 = offset & 0x07;
     shift0 = 8 - shift1;
-    buf = ep_alloc(actual_length);
+    buf = g_malloc(actual_length);
     octet0 = tvb_get_guint8(tvb, boffset);
     for (i=0; i<actual_length; i++) {
       octet1 = octet0;
@@ -142,6 +142,7 @@ static tvbuff_t *new_octet_aligned_subset(tvbuff_t *tvb, guint32 offset, asn1_ct
       buf[i] = (octet1 << shift1) | (octet0 >> shift0);
     }
     sub_tvb = tvb_new_child_real_data(tvb, buf, actual_length, length);
+    tvb_set_free_cb(sub_tvb, g_free);
     add_new_data_source(actx->pinfo, sub_tvb, "Unaligned OCTET STRING");
   } else {  /* aligned */
     sub_tvb = tvb_new_subset(tvb, boffset, actual_length, length);
@@ -195,7 +196,7 @@ tvbuff_t *new_octet_aligned_subset_bits(tvbuff_t *tvb, guint32 offset, asn1_ctx_
 	  /* Number of bits = even number of octets */
 	return new_octet_aligned_subset(tvb, offset, actx, length);
   }
-  buf = ep_alloc(length);
+  buf = g_malloc(length);
 
   if (actx->aligned)
   {
@@ -244,6 +245,7 @@ tvbuff_t *new_octet_aligned_subset_bits(tvbuff_t *tvb, guint32 offset, asn1_ctx_
     buf[i] = (guint8) (word & 0x00ff);
   }
   sub_tvb = tvb_new_child_real_data(tvb, buf, length, length);
+  tvb_set_free_cb(sub_tvb, g_free);
   add_new_data_source(actx->pinfo, sub_tvb, "Unaligned OCTET STRING");
   
   return sub_tvb;
diff --git a/epan/dissectors/packet-sdp.c b/epan/dissectors/packet-sdp.c
index 397fb75c1b..e5c0061eea 100644
--- a/epan/dissectors/packet-sdp.c
+++ b/epan/dissectors/packet-sdp.c
@@ -1155,7 +1155,7 @@ dissect_sdp_media(tvbuff_t *tvb, proto_item *ti,
 static tvbuff_t *
 ascii_bytes_to_tvb(tvbuff_t *tvb, packet_info *pinfo, gint len, gchar *msg)
 {
-	guint8 *buf = ep_alloc(10240);
+	guint8 *buf = g_malloc(10240);
 
 	/* arbitrary maximum length */
 	if(len<20480){
@@ -1220,6 +1220,7 @@ ascii_bytes_to_tvb(tvbuff_t *tvb, packet_info *pinfo, gint len, gchar *msg)
 			return NULL;
 		}
 		bytes_tvb = tvb_new_child_real_data(tvb, buf,i,i);
+                tvb_set_free_cb(bytes_tvb, g_free);
 		add_new_data_source(pinfo, bytes_tvb, "ASCII bytes to tvb");
 		return bytes_tvb;
 	}
diff --git a/epan/dissectors/packet-spnego.c b/epan/dissectors/packet-spnego.c
index a92eb40d00..4b21f25c9d 100644
--- a/epan/dissectors/packet-spnego.c
+++ b/epan/dissectors/packet-spnego.c
@@ -1,7 +1,7 @@
 /* Do not modify this file.                                                   */
 /* It is created automatically by the ASN.1 to Wireshark dissector compiler   */
 /* packet-spnego.c                                                            */
-/* ../../tools/asn2wrs.py -b -p spnego -c spnego.cnf -s packet-spnego-template spnego.asn */
+/* ../../tools/asn2wrs.py -b -p spnego -c ./spnego.cnf -s ./packet-spnego-template -D . spnego.asn */
 
 /* Input file: packet-spnego-template.c */
 
@@ -561,7 +561,7 @@ dissect_spnego_InnerContextToken(gboolean implicit_tag _U_, tvbuff_t *tvb _U_, i
    * token it dissected, so we can return the length of the part
    * we (and it) dissected.
    */
-  token_tvb = tvb_new_subset_remaining(tvb, offset);
+  token_tvb = tvb_new_subset(tvb, offset, -1, -1);
   if (next_level_value && next_level_value->wrap_handle) {
     len = call_dissector(next_level_value->wrap_handle, token_tvb, actx->pinfo,
                          subtree);
@@ -1136,6 +1136,7 @@ decrypt_gssapi_krb_arcfour_wrap(proto_tree *tree, packet_info *pinfo, tvbuff_t *
 			pinfo->gssapi_decrypted_tvb=tvb_new_child_real_data(tvb, 
 				output_message_buffer,
 				ret, ret);
+			tvb_set_free_cb(pinfo->gssapi_decrypted_tvb, g_free);
 			add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
 			return;
 		}
@@ -1204,12 +1205,11 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
 		return;
 	}
 
-	rotated = ep_alloc(tvb_length(tvb));
-
-	tvb_memcpy(tvb, rotated, 0, tvb_length(tvb));
+	rotated = tvb_memdup(tvb, 0, tvb_length(tvb));
 	res = rrc_rotate(rotated, tvb_length(tvb), rrc, TRUE);
 
 	next_tvb=tvb_new_child_real_data(tvb, rotated, tvb_length(tvb), tvb_reported_length(tvb));
+	tvb_set_free_cb(next_tvb, g_free);
 	add_new_data_source(pinfo, next_tvb, "GSSAPI CFX");
 
 	output = decrypt_krb5_data(tree, pinfo, usage, next_tvb,
@@ -1218,7 +1218,7 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
 	if (output) {
 		char *outdata;
 
-		outdata = ep_alloc(tvb_length(tvb));
+		outdata = g_malloc(tvb_length(tvb));
 		memcpy(outdata, output, tvb_length(tvb));
 		g_free(output);
 
@@ -1227,6 +1227,7 @@ decrypt_gssapi_krb_cfx_wrap(proto_tree *tree _U_, packet_info *pinfo _U_, tvbuff
 			datalen-16,
 			datalen-16);
 		add_new_data_source(pinfo, pinfo->gssapi_decrypted_tvb, "Decrypted GSS-Krb5");
+		tvb_set_free_cb(pinfo->gssapi_decrypted_tvb, g_free);
 		return;
 	}
 	return;
@@ -1963,7 +1964,7 @@ void proto_register_spnego(void) {
         NULL, HFILL }},
 
 /*--- End of included file: packet-spnego-hfarr.c ---*/
-#line 1379 "packet-spnego-template.c"
+#line 1380 "packet-spnego-template.c"
 	};
 
 	/* List of subtrees */
@@ -1985,7 +1986,7 @@ void proto_register_spnego(void) {
     &ett_spnego_InitialContextToken_U,
 
 /*--- End of included file: packet-spnego-ettarr.c ---*/
-#line 1389 "packet-spnego-template.c"
+#line 1390 "packet-spnego-template.c"
 	};
 
 	/* Register protocol */
diff --git a/epan/dissectors/packet-spnego.h b/epan/dissectors/packet-spnego.h
index 7dfc919ff9..12eb70901d 100644
--- a/epan/dissectors/packet-spnego.h
+++ b/epan/dissectors/packet-spnego.h
@@ -1,7 +1,7 @@
 /* Do not modify this file.                                                   */
 /* It is created automatically by the ASN.1 to Wireshark dissector compiler   */
 /* packet-spnego.h                                                            */
-/* ../../tools/asn2wrs.py -b -p spnego -c spnego.cnf -s packet-spnego-template spnego.asn */
+/* ../../tools/asn2wrs.py -b -p spnego -c ./spnego.cnf -s ./packet-spnego-template -D . spnego.asn */
 
 /* Input file: packet-spnego-template.h */
 
diff --git a/epan/dissectors/packet-vj.c b/epan/dissectors/packet-vj.c
index 9583741c33..1ed19c2e4d 100644
--- a/epan/dissectors/packet-vj.c
+++ b/epan/dissectors/packet-vj.c
@@ -380,6 +380,7 @@ dissect_vjuc(tvbuff_t *tvb, packet_info *pinfo, proto_tree * tree)
   if (ipsize < isize)
     isize = ipsize;
   next_tvb = tvb_new_child_real_data(tvb, buffer, isize, ipsize);
+  tvb_set_free_cb(next_tvb, g_free);
   add_new_data_source(pinfo, next_tvb, "VJ Uncompressed");
 
   /*
@@ -503,6 +504,7 @@ vjc_tvb_setup(tvbuff_t *src_tvb,
   tvb_memcpy(src_tvb, pbuf + hdr_len, offset, buf_len - hdr_len);
   memcpy(&tot_len, data_ptr + 2, 2);
   *dst_tvb = tvb_new_child_real_data(src_tvb, pbuf, buf_len, g_ntohs(tot_len));
+  tvb_set_free_cb(*dst_tvb, g_free);
   add_new_data_source(pinfo, *dst_tvb, "VJ Decompressed");
   return VJ_OK;
 }
diff --git a/epan/dissectors/packet-zbee-security.c b/epan/dissectors/packet-zbee-security.c
index 8eb891e7d2..0ba09c731c 100644
--- a/epan/dissectors/packet-zbee-security.c
+++ b/epan/dissectors/packet-zbee-security.c
@@ -580,6 +580,7 @@ dissect_zbee_secure(tvbuff_t *tvb, packet_info *pinfo, proto_tree* tree, guint o
 
     /* Setup the new tvbuff_t and return */
     payload_tvb = tvb_new_child_real_data(tvb, dec_buffer, payload_len, payload_len);
+    tvb_set_free_cb(payload_tvb, g_free);
     add_new_data_source(pinfo, payload_tvb, "Decrypted ZigBee Payload");
     /* Done! */
     return payload_tvb;