[Snort-devel] tags crash

Chris Green cmg at ...81...
Sun Aug 12 13:44:55 EDT 2001


(gdb) p /x *RootPtr
$6 = {root = 0x84d8000, cmp = 0x8070a54, count = 0x1, flags = 0x0}

(gdb) p /x  *ssn_tag_cache_ptr
$8 = {root = 0x84d8000, cmp = 0x8070a54, count = 0x1, flags = 0x0}

Martin Roesch <roesch at ...402...> writes:

> *sigh*
> 
> Ok, 'up 2' and 'p /x *RootPtr' please.  Then 'up 1' and 'p /x
> *ssn_tag_cache_ptr'.  Thanks :)
> 
>     -Marty
> 
> Chris Green wrote:
>> 
>> Just sending this off ( cvs updated last night ).
>> 
>> #0  Neighbor (P=0x84fc428, whichway=2) at ../snort/ubi_BinTree.c:418
>> 418         if( NULL != P->Link[ whichway ] )
>> (gdb) bt
>> #0  Neighbor (P=0x84fc428, whichway=2) at ../snort/ubi_BinTree.c:418
>> #1  0x80737d0 in ubi_btNext (P=0x84fc428) at ../snort/ubi_BinTree.c:879
>> #2  0x80738d8 in ubi_btTraverse (RootPtr=0x80a3630, EachNode=0x8070ae0 <PruneTraverse>, UserData=0xbffff0a8)
>>     at ../snort/ubi_BinTree.c:1014
>> #3  0x8071083 in PruneTagCache (thetime=997630968, mustdie=0) at ../snort/tag.c:540
>> #4  0x8071027 in CheckTagList (p=0xbffff1d8, event=0xbffff158) at ../snort/tag.c:514
>> #5  0x8056a9f in Detect (p=0xbffff1d8) at ../snort/rules.c:3599
>> #6  0x805685b in Preprocess (p=0xbffff1d8) at ../snort/rules.c:3435
>> #7  0x804babb in ProcessPacket (user=0x0, pkthdr=0xbffff698, pkt=0x80c6540 "") at ../snort/snort.c:534
>> #8  0x40040207 in pcap_read_packet () from /usr/lib/libpcap.so.0
>> #9  0x4004124f in pcap_loop () from /usr/lib/libpcap.so.0
>> #10 0x804cf47 in InterfaceThread (arg=0x0) at ../snort/snort.c:1561
>> #11 0x804b98b in main (argc=15, argv=0xbffff84c) at ../snort/snort.c:467
>> #12 0x40207b5c in __libc_start_main (main=0x804b30c <main>, argc=15, ubp_av=0xbffff84c, init=0x804a610 <_init>,
>>     fini=0x8078bbc <_fini>, rtld_fini=0x4000d634 <_dl_fini>, stack_end=0xbffff844)
>> 
>> at ../sysdeps/generic/libc-start.c:129
>> 
>> (gdb) p *P
>> Cannot access memory at address 0x84fc428
>> --
>> Chris Green <cmg at ...81...>
>> Laugh and the world laughs with you, snore and you sleep alone.
>> 
>> _______________________________________________
>> Snort-devel mailing list
>> Snort-devel at lists.sourceforge.net
>> http://lists.sourceforge.net/lists/listinfo/snort-devel
> 
> --
> Martin Roesch
> roesch at ...402...
> http://www.sourcefire.com - http://www.snort.org

-- 
Chris Green <cmg at ...81...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-devel mailing list