[Snort-devel] snort & sparc (bus error) again

Ricardo A. Gorosito rgorosito at ...1077...
Thu Nov 28 17:52:03 EST 2002


I'll try to fix snort for get it running on sparc/linux. But I need some 
help.

Runing snort, first bus error that I get is on:

Program received signal SIGBUS, Bus error.
DecodeTCP (pkt=0x14bada "\004\021\f?\016c\016RE\201\231g\200\030\026?(?",
    len=43, p=0xeffff230) at decode.c:1862
1862            ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);
(gdb) *print &p->iph->ip_src*
$1 = (struct in_addr *) 0x14bad2
(gdb) *print p->iph*
$2 = (IPHdr *) 0x14bac6
(gdb) *print p*
$3 = (Packet *) 0xeffff230

sparc need that p->iph->ip_src be aligned to 32bits, and you can see 
that it is not.
You can save the problem with:

char *pAux;
...
pAux=(char *)&(ph.sip);
pAux[0] = *((char *)&(p->iph->ip_src.s_addr)+0);
pAux[1] = *((char *)&(p->iph->ip_src.s_addr)+1);
pAux[2] = *((char *)&(p->iph->ip_src.s_addr)+2);
pAux[3] = *((char *)&(p->iph->ip_src.s_addr)+3);

but bus errors are in to much lines of code.

The problem is on DecodeIP:

/* lay the IP struct over the raw data */
p->iph = (IPHdr *) pkt;

because iph is not aligned on raw data (with an ethernet header).

Solutions?

1) fix all sites when unaligned data is used
2) alloc  new mem for packet? ( where? if it is on DecodeIP wheres is 
free()? need to modify ProcessPacket? )
3) see how cc from solaris make 'black magic' and make it run. (I don't 
have that compiler)

What snort's hackers recommend me as start point?
 
Thanks in advance.

Ricardo.-
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20021128/9bfe0767/attachment.html>


More information about the Snort-devel mailing list