[Snort-devel] RE: [Snort-users] snort 1.7 segmentation fault

Martin Roesch roesch at ...48...
Thu Jan 18 00:39:19 EST 2001


Patched and committed.  Don't be suprised that no one caught it before,
I'm constantly amazed by the broken stuff the people sometimes overlook
for one reason or another. :)

   -Marty

James Hoagland wrote:
> 
> At 1:55 PM -0600 1/14/01, Hammerle, Tye F wrote:
> >Here's what I got from gdb snort snort.core  This is on an OpenBSD 2.8 x386.
> >
> >Guessing from the anonmsensor parts it's spade that that is killing
> >me, I'll try commenitng that out and see what happens. Someone else
> >mentioned that they needed to recomile libpcap. It looks like a
> >bunch of the errors are related to that. Maybe I should try to
> >recompile libpcap? I wonder what changed between snort 1.7b9 and 1.7
> >that would cause this? 'course that's the $64k question I suppose.
> 
> Okay, figured out the problem with Spade adapt and adapt3 modes; a
> bit of overlooked initialization that I'm surprised hasn't come up
> before.  Here is a patch, can someone please commit the change?
> 
> Thanks,  Jim
> 
> *** ./spp_anomsensor.c.orig     Wed Jan 17 17:30:00 2001
> --- ./spp_anomsensor.c  Wed Jan 17 17:29:34 2001
> ***************
> *** 603,606 ****
> --- 603,607 ----
>          top_adapt_list->next= (ll_double *)malloc(sizeof(ll_double));
>          top_adapt_list->next->val= 0.0;
> +       top_adapt_list->next->next= NULL;
>          top_adapt_list_size= 1;
> 
> ***************
> *** 1138,1141 ****
> --- 1139,1143 ----
>          adapt3anoms->next= (ll_double *)malloc(sizeof(ll_double));
>          adapt3anoms->next->val= 0.0;
> +       adapt3anoms->next->next= NULL;
>          adapt3anoms_size= 1;
>          completed_obs_per= 0;
> --
> |*   Jim Hoagland, Associate Researcher, Silicon Defense    *|
> |*               hoagland at ...60...                *|
> |*              http://www.silicondefense.com/              *|
> |*  Voice: (530) 756-7317              Fax: (707) 445-4222  *|
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...48...
http://www.snort.org




More information about the Snort-devel mailing list