[Snort-devel] tags crash

Martin Roesch roesch at ...402...
Sun Aug 12 18:59:09 EDT 2001


Ok, problem found and fix committed to CVS.  


     -Marty

Chris Green wrote:
> 
> (gdb) p /x *RootPtr
> $6 = {root = 0x84d8000, cmp = 0x8070a54, count = 0x1, flags = 0x0}
> 
> (gdb) p /x  *ssn_tag_cache_ptr
> $8 = {root = 0x84d8000, cmp = 0x8070a54, count = 0x1, flags = 0x0}
> 
> Martin Roesch <roesch at ...402...> writes:
> 
> > *sigh*
> >
> > Ok, 'up 2' and 'p /x *RootPtr' please.  Then 'up 1' and 'p /x
> > *ssn_tag_cache_ptr'.  Thanks :)
> >
> >     -Marty
> >
> > Chris Green wrote:
> >>
> >> Just sending this off ( cvs updated last night ).
> >>
> >> #0  Neighbor (P=0x84fc428, whichway=2) at ../snort/ubi_BinTree.c:418
> >> 418         if( NULL != P->Link[ whichway ] )
> >> (gdb) bt
> >> #0  Neighbor (P=0x84fc428, whichway=2) at ../snort/ubi_BinTree.c:418
> >> #1  0x80737d0 in ubi_btNext (P=0x84fc428) at ../snort/ubi_BinTree.c:879
> >> #2  0x80738d8 in ubi_btTraverse (RootPtr=0x80a3630, EachNode=0x8070ae0 <PruneTraverse>, UserData=0xbffff0a8)
> >>     at ../snort/ubi_BinTree.c:1014
> >> #3  0x8071083 in PruneTagCache (thetime=997630968, mustdie=0) at ../snort/tag.c:540
> >> #4  0x8071027 in CheckTagList (p=0xbffff1d8, event=0xbffff158) at ../snort/tag.c:514
> >> #5  0x8056a9f in Detect (p=0xbffff1d8) at ../snort/rules.c:3599
> >> #6  0x805685b in Preprocess (p=0xbffff1d8) at ../snort/rules.c:3435
> >> #7  0x804babb in ProcessPacket (user=0x0, pkthdr=0xbffff698, pkt=0x80c6540 "") at ../snort/snort.c:534
> >> #8  0x40040207 in pcap_read_packet () from /usr/lib/libpcap.so.0
> >> #9  0x4004124f in pcap_loop () from /usr/lib/libpcap.so.0
> >> #10 0x804cf47 in InterfaceThread (arg=0x0) at ../snort/snort.c:1561
> >> #11 0x804b98b in main (argc=15, argv=0xbffff84c) at ../snort/snort.c:467
> >> #12 0x40207b5c in __libc_start_main (main=0x804b30c <main>, argc=15, ubp_av=0xbffff84c, init=0x804a610 <_init>,
> >>     fini=0x8078bbc <_fini>, rtld_fini=0x4000d634 <_dl_fini>, stack_end=0xbffff844)
> >>
> >> at ../sysdeps/generic/libc-start.c:129
> >>
> >> (gdb) p *P
> >> Cannot access memory at address 0x84fc428
> >> --
> >> Chris Green <cmg at ...81...>
> >> Laugh and the world laughs with you, snore and you sleep alone.
> >>
> >> _______________________________________________
> >> Snort-devel mailing list
> >> Snort-devel at lists.sourceforge.net
> >> http://lists.sourceforge.net/lists/listinfo/snort-devel
> >
> > --
> > Martin Roesch
> > roesch at ...402...
> > http://www.sourcefire.com - http://www.snort.org
> 
> --
> Chris Green <cmg at ...81...>
> This is my signature. There are many like it but this one is mine.
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...402...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-devel mailing list