[Snort-devel] [ snort-Bugs-551080 ] Bus Error with OpenBSD 2.8 & SPARC

noreply at ...12... noreply at ...12...
Wed May 29 07:23:04 EDT 2002


Bugs item #551080, was opened at 2002-05-01 10:09
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=551080&group_id=3357

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: Bus Error with OpenBSD 2.8 & SPARC

Initial Comment:
I was running snort 1.8.1 and decided to upgrade to
1.8.6. Compiled perfectly, didn't use any compile options.
Got 'bus error' when I ran snort by itself, no arguments.
Tried the same thing with 1.8.5 - same results. Tried
compiling with --debug option.. didn't get any extra
info. Here is the gdb output:

root at ...1350...:snort-1.8.5 {253} gdb snort snort.core 
GNU gdb 4.16.1
Copyright 1996 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public
License, and you are
welcome to change it and/or distribute copies of it
under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show
warranty" for details.
This GDB was configured as "sparc-unknown-openbsd2.8"...
Core was generated by `snort'.
Program terminated with signal 10, Bus error.
Reading symbols from /usr/libexec/ld.so...done.
Reading symbols from /usr/lib/libpcap.so.1.1...done.
Reading symbols from /usr/lib/libm.so.0.1...done.
Reading symbols from /usr/lib/libc.so.25.2...done.
#0  0x46d28 in InitStream4Pkt () at spp_stream4.c:2938
2938        stream_pkt->iph->ip_ver   = 0x4;
(gdb) bt
#0  0x46d28 in InitStream4Pkt () at spp_stream4.c:2938
#1  0x41e20 in Stream4Init (args=0xf7ffcc88
"/var/log/snort/session.log") at spp_stream4.c:597
#2  0x12b34 in ParsePreprocessor (rule=0x802c0 "") at
rules.c:1336
#3  0x1207c in ParseRule (rule_file=0x8183160,
prule=0xf7fff278 "preprocessor stream4: detect_scans", 
    inclevel=0) at rules.c:538
#4  0x1192c in ParseRulesFile (file=0x5b000 "",
inclevel=0) at rules.c:198
#5  0x93a4 in ReadConfFile () at snort.c:3310
#6  0x2e5c in main (argc=1, argv=0xf7fff824) at snort.c:192

Thanks,

John

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-05-27 02:30

Message:
Logged In: NO 

Exactly the same thing happens to me with snort releases
from 1.8.4 up to 1.8.6, on a very recent debian/SPARC woody
installation... the program receives a SIGBUS while
manipulating iph->ip-ver.
Disabling the stream4 preprocessor just moves the bug inside
DecodeIP()...

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-05-18 07:25

Message:
Logged In: NO 

Same thing under RH 6.2 on Sparc:
GNU gdb 4.17.0.11 with Linux support
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public 
License, and you are
welcome to change it and/or distribute copies of it under 
certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show 
warranty" for details.
This GDB was configured as "sparc-redhat-linux"...
Core was generated by `./snort -c snort.conf'.
Program terminated with signal 10, Bus error.
Reading symbols from /lib/libm.so.6...done.
Reading symbols from /lib/libnsl.so.1...done.
Reading symbols from /lib/libc.so.6...done.
Reading symbols from /lib/ld-linux.so.2...done.
Reading symbols from /lib/libnss_nisplus.so.2...done.
Reading symbols from /lib/libnss_files.so.2...done.
#0  InitStream4Pkt () at spp_stream4.c:2938
2938        stream_pkt->iph->ip_ver   = 0x4;
(gdb) bt
#0  InitStream4Pkt () at spp_stream4.c:2938
#1  0x4333c in Stream4Init 
(args=0xefffc1d8 "/var/log/snort/session.log")
    at spp_stream4.c:597
#2  0x1d35c in ParsePreprocessor (rule=0xb0c38 "") at 
rules.c:1336
#3  0x1c948 in ParseRule (rule_file=0xb1ac0,
    prule=0xefffe7c0 "preprocessor stream4: detect_scans", 
inclevel=0)
    at rules.c:538
#4  0x1c40c in ParseRulesFile (file=0x83c00 "", inclevel=0) 
at rules.c:198
#5  0x12178 in main (argc=3, argv=0xefffed74) at snort.c:335
#6  0x500b28d0 in __libc_start_main () 
at ../sysdeps/generic/libc-start.c:78


----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=551080&group_id=3357




More information about the Snort-devel mailing list