[Snort-devel] linux/sparc BUS ERROR [more info]

Ricardo A. Gorosito rgorosito at ...1077...
Wed Jan 16 10:46:14 EST 2002


This is the output:

(gdb) set args -v
(gdb) run
Program received signal SIGBUS, Bus error.
0x0001b408 in DecodeIP (pkt=0x9977e "E\020", len=132, p=0xeffff398) at
1194        if(p->iph->ip_ver != 4)
(gdb) set print address on
(gdb) bt
#0  0x0001b408 in DecodeIP (pkt=0x9977e "E\020", len=132, p=0xeffff398) at
#1  0x0001280c in ProcessPacket (user=0x0, pkthdr=0x84, pkt=0xeffff398
"ïÿøx") at snort.c:486
#2  0x700336f8 in pcap_read_packet (handle=0x98ef0, callback=0x127e8
<ProcessPacket>, userdata=0x0) at ./pcap-linux.c:587
#3  0x700349e0 in pcap_loop (p=0x98ef0, cnt=-1, callback=0x127e8
<ProcessPacket>, user=0x0) at ./pcap.c:79
#4  0x00014414 in InterfaceThread (arg=0x0) at snort.c:1663
#5  0x000127e0 in main (argc=477716, argv=0xeffffb24) at snort.c:469
#6  0x7013d850 in __libc_start_main (main=0x11ee8 <main>, argc=2,
ubp_av=0xeffffb24, init=0x11bf8 <_init>, fini=0x7002d9ac <_dl_debug_mask>,
    rtld_fini=0x7000f8e0 <_dl_fini>, stack_end=0xeffffc08) at
(gdb) print &p->iph->ip_src
$1 = (struct in_addr *) 0x9978a

Thanks, Ricardo.

Roelof JT Jonkman escribió:

> Ricardo,
> I'm sorry, but could you do this:
> (basically we need to see the address of p->iph->ip_src)
> - run gdb with the core
> - set print address on
> - bt
> - print &p->iph->ip_src
> That should show the address of the pointer, if that is not modulo 4 or 8,
> than presto that is the problem. (And proves Fyodor right)
> roel

Ricardo Ariel Gorosito - rgorosito at ...1077...
 Administración Federal de Ingresos Públicos
      Departamento Seguridad Informática

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20020116/1a1597b8/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: rgorosito.vcf
Type: text/x-vcard
Size: 359 bytes
Desc: Tarjeta de Ricardo A. Gorosito
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20020116/1a1597b8/attachment.vcf>

More information about the Snort-devel mailing list