[Snort-devel] snort-1.8-RELEASE core

Hartmut Prochaska hartmut.prochaska at ...224...
Wed Jul 11 16:18:05 EDT 2001


Hi,

did you got a  SIGABORT? 
Then I think it could be happened because of line 3426 in rules.c. An abort 
will be triggered there, if the pointer to func for a node in the 
preproccessinglist is empty.
Is my assumption correct?

But as many users got problems with the preprocessing, I assume, that the 
preprocessinglist isn't terminated correctly. Could this have been happened 
somewhere?

I am too new to snortprogramming, so I can't verify this fast. It is just an 
idea.

Ciao
Hartmut 

at Tuesday 10 July 2001 17:47 you wrote:
> I just got a core dump with snort-1.8-RELEASE.
> My backtrace looks like this:
> (gdb) bt
> #0  0x72 in ?? ()
> #1  0x80766eb in FlushStream (s=0x8aa0c10, p=0xbffff390, direction=0) at
> spp_stream4.c:2499
> #2  0x8074b5c in ReassembleStream4 (p=0xbffff390) at spp_stream4.c:1084
> #3  0x8056046 in Preprocess (p=0xbffff390) at rules.c:3427
> #4  0x804baab in ProcessPacket (user=0x0, pkthdr=0xbffff850,
> pkt=0x80d32f2 "") at snort.c:512
> #5  0x8078772 in pcap_read ()
> #6  0x807912f in pcap_loop ()
> #7  0x804ce58 in InterfaceThread (arg=0x0) at snort.c:1441
> #8  0x804b97b in main (argc=5, argv=0xbffffa34) at snort.c:445
> #9  0x401feb65 in __libc_start_main (main=0x804b31c <main>, argc=5,
> ubp_av=0xbffffa34, init=0x804a6c4 <_init>,
>     fini=0x8082bbc <_fini>, rtld_fini=0x4000df24 <_dl_fini>,
> stack_end=0xbffffa2c) at ../sysdeps/generic/libc-start.c:111
>
> I haven't taken a closer look to see whats going on yet. Has anyone else
> had a similar problem?
>
> -Mike

-- 
"There are two major products that come out of Berkeley: LSD and
    UNIX.  We don't believe this to be a coincidence."
                                          - Jeremy S. Anderson




More information about the Snort-devel mailing list