[Snort-devel] coredump on latest CVS build

Martin Roesch roesch at ...402...
Fri May 25 17:12:13 EDT 2001


Well, yeah, but the temporary solution is to see what's screwed up in
the rules file in the first place. :)  Don't worry, I'm going to debug
this one in depth when I get a little time this weekend.

     -Marty

tlewis at ...255... wrote:
> 
> When any rule causes a segfaul, either in loading or examination,
> can we consider that a bug?  Input should never crash a program...
> 
> --
> Todd Lewis
> tlewis at ...255...
> 
> On Thu, 24 May 2001, Martin Roesch wrote:
> 
> > Looks like a bad rule, that shouldn't happen in normal operations (i.e.
> > we haven't modified that code in a long time).
> >
> >      -Marty
> >
> > Storms of Perfection wrote:
> > >
> > > Here's a backtrace:
> > >
> > > #0  IntegrityCheck (rtn_head=0x80bff30, rulename=0x80bd1f8 "alert",
> > > listname=0x808adc0 "TCP Chains") at rules.c:4100
> > > 4100                    ofl_idx = ofl_idx->next;
> > > (gdb) bt
> > > #0  IntegrityCheck (rtn_head=0x80bff30, rulename=0x80bd1f8 "alert",
> > > listname=0x808adc0 "TCP Chains") at rules.c:4100
> > > #1  0x805324b in IntegrityCheckRules () at rules.c:385
> > > #2  0x8053085 in ParseRulesFile (file=0x80a2e88 "./snort.conf", inclevel=0)
> > > at rules.c:252
> > > #3  0x804b5d5 in main (argc=3, argv=0xbffffb04) at snort.c:306
> > > #4  0x40154b65 in __libc_start_main (main=0x804b19c <main>, argc=3,
> > > ubp_av=0xbffffb04, init=0x804a5b4 <_init>,
> > >      fini=0x8086e6c <_fini>, rtld_fini=0x4000df24 <_dl_fini>,
> > > stack_end=0xbffffafc) at ../sysdeps/generic/libc-start.c:111
> > >
> > > _______________________________________________
> > > Snort-devel mailing list
> > > Snort-devel at lists.sourceforge.net
> > > http://lists.sourceforge.net/lists/listinfo/snort-devel
> >
> > --
> > Martin Roesch
> > roesch at ...402...
> > http://www.sourcefire.com - http://www.snort.org
> >
> > _______________________________________________
> > Snort-devel mailing list
> > Snort-devel at lists.sourceforge.net
> > http://lists.sourceforge.net/lists/listinfo/snort-devel
> >

--
Martin Roesch
roesch at ...402...
http://www.sourcefire.com - http://www.snort.org




More information about the Snort-devel mailing list