[Snort-devel] xml module dumping core

roman at ...49... roman at ...49...
Mon Oct 15 20:54:24 EDT 2001


There was a patch committed on Sept. 28 which probably fixes this
issue.  Update from CVS.

Roman  

On Mon, 8 Oct 2001, Ludovico Magnocavallo wrote:

> platform: Redhat Linux 6.2 i386
> snort version: 1.8 (fresh compile from snort-1.8.1-RELEASE.tar.gz)
>
> output plugin xml, protocol http, as sson as something needs to be sent to
> the http server, snort core dumps
> 
> output from gdb:
> 
> (gdb) bt
> #0  chunk_free (ar_ptr=0x40148d40, p=0x840961a) at malloc.c:3049
> #1  0x400b3f9a in __libc_free (mem=0x8409622) at malloc.c:3023  
> #2  0x80615d3 in freetag (root=0x8416878) at spo_xml.c:1326     
> #3  0x80615bb in freetag (root=0x80d4788) at spo_xml.c:1322   
> #4  0x80615bb in freetag (root=0x80f7290) at spo_xml.c:1322
> #5  0x8061560 in flush_data (d=0x80f7240) at spo_xml.c:1302
> #6  0x8060fb8 in LogXml (p=0xbffff4a4, msg=0x8409570 "ICMP redirect host",
>     arg=0x80f7240, event=0x8409324) at spo_xml.c:520
> #7  0x80551c4 in CallAlertFuncs (p=0xbffff4a4,
>     message=0x8409570 "ICMP redirect host", head=0x809c958, event=0x8409324)
>     at rules.c:3534
> #8  0x8056039 in AlertAction (p=0xbffff4a4, otn=0x8408b00, event=0x8409324)
>     at rules.c:4942
> #9  0x80554aa in EvalHeader (rtn_idx=0x8218b28, p=0xbffff4a4) at
> rules.c:3798
> #10 0x8055399 in EvalPacket (List=0x809c958, mode=2, p=0xbffff4a4)
>     at rules.c:3697
> #11 0x805523c in Detect (p=0xbffff4a4) at rules.c:3590
> #12 0x805506c in Preprocess (p=0xbffff4a4) at rules.c:3432
> #13 0x804ab4c in ProcessPacket (user=0x0, pkthdr=0xbffff954, pkt=0x80cf6fa
> "")
>     at snort.c:534
> #14 0x8076336 in pcap_read ()
> #15 0x8076c61 in pcap_loop ()
> #16 0x804be33 in InterfaceThread (arg=0x0) at snort.c:1561
> #17 0x804aa48 in main (argc=4, argv=0xbffffab4) at snort.c:467  
> (gdb) quit
> 
> 
> Thanks for any help,
>     
> Ludovico Magnocavallo



---------------------------------------------
This message was sent using Voicenet WebMail.
      http://www.voicenet.com/webmail/






More information about the Snort-devel mailing list