[Snort-devel] now a crash in spp_tcp_stream3

Martin Roesch roesch at ...402...
Sat May 12 18:00:53 EDT 2001


I've been playing with it.  AVL nodes are being allocated and popped off
the tree properly, nothing's hanging around.  I've been seeing "snort in
free(): warning: chunk is already free." warning messages in
TcpStream3PruneSession() where it frees the sptr near the bottom of the
function.  I think memory is getting stomped someplace and I can't
figure out where.  I've been seeing occaisional crashes in
TcpStream3FillBuffer() where the sptr is completely hosed (sp and cp set
to 0 or something improbable, c_stream_size at 0 but c_count at 17000+,
etc).  

Here's my latest run:
Starting dump at: Sat May 12 17:11:36 2001

==========================================
Session 0, Sat May 12 17:11:24 2001

[s_count: 7  s_size: 79]
[c_count: 5  c_size: 9]
==========================================

Starting dump at: Sat May 12 17:11:52 2001

==========================================
Session 0, Sat May 12 17:11:24 2001

[s_count: 7  s_size: 79]
[c_count: 25  c_size: 40]
==========================================

Starting dump at: Sat May 12 17:13:55 2001

==========================================
==========================================

Starting dump at: Sat May 12 17:15:26 2001

==========================================
Session 4, Sat May 12 17:15:25 2001

[s_count: 0  s_size: 0]
[c_count: 1  c_size: 494]
Session 2, Sat May 12 17:15:25 2001

[s_count: 2  s_size: 0]
[c_count: 0  c_size: 0]
Session 6, Sat May 12 17:15:25 2001

[s_count: 1  s_size: 0]
[c_count: 0  c_size: 0]
==========================================

Starting dump at: Sat May 12 17:17:52 2001

==========================================
Session 4, Sat May 12 17:15:25 2001

[s_count: 0  s_size: 0]
[c_count: 0  c_size: 0]
Session 2, Sat May 12 17:15:25 2001

[s_count: 2  s_size: 0]
[c_count: 0  c_size: 0]
Session 6, Sat May 12 17:15:25 2001

[s_count: 1  s_size: 0]
[c_count: 0  c_size: 0]
==========================================



Todd Lewis wrote:
> 
> BTW, if anyone else is not having the problem I reported, then could
> you please apply the patch, run some traffic through snort, send it
> SIGUSR2 every minute or so until the memory leak is good and visible,
> and send me back the resulting file stream3_leak_finder.log?
> 
> --
> Todd Lewis
> tlewis at ...255...
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...402...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-devel mailing list