[Snort-devel] Is stream3 working?

Martin Roesch roesch at ...402...
Thu May 10 10:26:23 EDT 2001


Hi Joe,
    OS?  Do you still have the core file?

   -Marty

Joe McAlerney wrote:
> 
> I got another seg fault in a different part of the stream3 code.  Is
> pdata->data guarenteed to exist?
> 
> -Joe M.
> 
> --
> |   Joe McAlerney     joey at ...63...   |
> | Silicon Defense - Technical Support for Snort |
> |       http://www.silicondefense.com/          |
> +--                                           --+
> 
> -*> Snort! <*-
> Version 1.8-beta5 (Build 19)
> By Martin Roesch (roesch at ...16..., www.snort.org)
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x402070fc in chunk_free (ar_ptr=0x402ab300, p=0x84bc920) at
> malloc.c:3128
> 3128    malloc.c: No such file or directory.
> (gdb) bt
> #0  0x402070fc in chunk_free (ar_ptr=0x402ab300, p=0x84bc920) at
> malloc.c:3128
> #1  0x40206e54 in __libc_free (mem=0x84bc928) at malloc.c:3054
> #2  0x8073968 in TcpStream3FillBuffer (sptr=0x80b2150, buf=0x84ac89c "",
>     psize=345, server=0) at spp_tcp_stream3.c:1211
> #3  0x8073839 in TcpStream3Packetize (sptr=0x80b2150, pb=0xbfffeeb0,
>     psize=345, server_packet=1) at spp_tcp_stream3.c:1160
> #4  0x8073088 in TcpStream3Packet (p=0xbfffeeb0) at
> spp_tcp_stream3.c:583
> #5  0x8055a46 in Preprocess (p=0xbfffeeb0) at rules.c:3358
> #6  0x804b61f in ProcessPacket (user=0x0, pkthdr=0xbffff350,
> pkt=0x80b11d0 "")
>     at snort.c:501
> #7  0x8073f52 in pcap_read_packet ()
> #8  0x8074ceb in pcap_loop ()
> #9  0x804c8ec in InterfaceThread (arg=0x0) at snort.c:1377
> #10 0x804b4ef in main (argc=9, argv=0xbffff504) at snort.c:434
> #11 0x401a4f31 in __libc_start_main (main=0x804aeac <main>, argc=9,
>     ubp_av=0xbffff504, init=0x804a298 <_init>, fini=0x807ce7c <_fini>,
>     rtld_fini=0x4000e274 <_dl_fini>, stack_end=0xbffff4fc)
>     at ../sysdeps/generic/libc-start.c:129
> (gdb)
> Martin Roesch wrote:
> >
> > Hey guys,
> >      Well, I updated the stream3 code with some quick bug fixes about 18
> > hours ago, can I assume by the relative silence that it's working for
> > people now?
> >
> >      -Marty
> >
> > --
> > Martin Roesch
> > roesch at ...402...
> > http://www.sourcefire.com - http://www.snort.org
> >
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...402...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-devel mailing list