[Snort-devel] tags splay crash

Chris Green cmg at ...81...
Fri Jul 6 13:42:31 EDT 2001


Slightly different one:

#0  Rotate (p=0x8181d88) at ubi_SplayTree.c:215
215           tmp->Link[ubi_trPARENT] = parentp;
(gdb) bt
#0  Rotate (p=0x8181d88) at ubi_SplayTree.c:215
#1  0x806f905 in Splay (SplayWithMe=0x8181d88) at ubi_SplayTree.c:252
#2  0x806f991 in ubi_sptRemove (RootPtr=0x818d438, DeadNode=0x8181d88) at ubi_SplayTree.c:346
#3  0x806ca67 in PruneTraverse (NodePtr=0x8181d88, data=0xbfffec78) at tag.c:228
#4  0x806f768 in ubi_btTraverse (RootPtr=0x818d438, EachNode=0x806ca48 <PruneTraverse>, UserData=0xbfffec78) at ubi_BinTree.c:1006
#5  0x806d02f in PruneTagCache (thetime=994434994, mustdie=0) at tag.c:545
#6  0x806cfd5 in CheckTagList (p=0xbfffeda8, event=0xbfffed28) at tag.c:519
#7  0x8053283 in Detect (p=0xbfffeda8) at rules.c:3586
#8  0x805305f in Preprocess (p=0xbfffeda8) at rules.c:3429
#9  0x804896b in ProcessPacket (user=0x0, pkthdr=0xbffff258, pkt=0x81c2618 "") at snort.c:512
#10 0x8073417 in pcap_read_packet ()
#11 0x807445f in pcap_loop ()
#12 0x8049dab in InterfaceThread (arg=0x0) at snort.c:1436
#13 0x804883b in main (argc=11, argv=0xbffff40c) at snort.c:445
#14 0x80ea4d2 in __libc_start_main (main=0x80481dc <main>, argc=11, ubp_av=0xbffff40c, init=0x80480b4 <_init>, fini=0x8143400 <_fini>, rtld_fini=0, stack_end=0xbffff404)
    at ../sysdeps/generic/libc-start.c:129
(gdb) p *p
$1 = {Link = {0x861ac68, 0x8181d80, 0x8619610}, gender = 16 '\020', balance = -106 '\226'}

Chris Green <cmg at ...81...> writes:

> I added a tag to most of the web rules for 5 packets on the session
> and here's the backtrace
> 
> gdb sbin/snort /var/tmp/core.snort-994431600 
> GNU gdb 5.0
> Copyright 2000 Free Software Foundation, Inc.
> GDB is free software, covered by the GNU General Public License, and you are
> welcome to change it and/or distribute copies of it under certain conditions.
> Type "show copying" to see the conditions.
> There is absolutely no warranty for GDB.  Type "show warranty" for details.
> This GDB was configured as "i386-redhat-linux"...
> Core was generated by `sbin/snort -A fast -b -l ./log2 -d -i eth1 -c etc/snort/snort.conf'.
> Program terminated with signal 11, Segmentation fault.
> #0  0x806f8c0 in Rotate (p=0x8181df8) at ubi_SplayTree.c:223
> 223           tmp->Link[(int)(p->gender)] = p;
> (gdb) bt
> #0  0x806f8c0 in Rotate (p=0x8181df8) at ubi_SplayTree.c:223
> #1  0x806f911 in Splay (SplayWithMe=0x8181df8) at ubi_SplayTree.c:254
> #2  0x806f991 in ubi_sptRemove (RootPtr=0x818d438, DeadNode=0x8181df8) at ubi_SplayTree.c:346
> #3  0x806ca67 in PruneTraverse (NodePtr=0x8181df8, data=0xbfffec78) at tag.c:228
> #4  0x806f768 in ubi_btTraverse (RootPtr=0x818d438, EachNode=0x806ca48 <PruneTraverse>, UserData=0xbfffec78) at ubi_BinTree.c:1006
> #5  0x806d02f in PruneTagCache (thetime=994431511, mustdie=0) at tag.c:545
> #6  0x806cfd5 in CheckTagList (p=0xbfffeda8, event=0xbfffed28) at tag.c:519
> #7  0x8053283 in Detect (p=0xbfffeda8) at rules.c:3586
> #8  0x805305f in Preprocess (p=0xbfffeda8) at rules.c:3429
> #9  0x804896b in ProcessPacket (user=0x0, pkthdr=0xbffff258, pkt=0x81c2618 "") at snort.c:512
> #10 0x8073417 in pcap_read_packet ()
> #11 0x807445f in pcap_loop ()
> #12 0x8049dab in InterfaceThread (arg=0x0) at snort.c:1436
> #13 0x804883b in main (argc=11, argv=0xbffff40c) at snort.c:445
> -- 
> Chris Green <cmg at ...81...>
> Don't use a big word where a diminutive one will suffice.
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

-- 
Chris Green <cmg at ...81...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-devel mailing list