[Snort-devel] Core on 1.9beta6 build 207

Phil Wood cpw at ...86...
Fri Sep 20 12:49:03 EDT 2002


My guess is that args contains a NULL.

    void ParseConfig(char *rule)
    {
        char **toks;
        char **config_decl;
        char *args = NULL;
        char *config;
        int num_toks;
    
        toks = mSplit(rule, ":", 2, &num_toks, 0);
    
        if(num_toks > 1)
        {
            args = toks[1];
        }

Later,

On Wed, Sep 18, 2002 at 05:02:04PM -0700, Erek Adams wrote:
> 
> While working on tracking down an oddity, I discovered a way to force a core.
> 
> I built snort with --enable-debug.  I added the following lines to snort.conf:
> 
>  config reference_net: 10.10.10.0/24
>  config daemon
> 
> Each time I start it, with that setup, I get a core.  Here's the backtrace:
> 
> #0  0xff1b6f3c in strlen () from /usr/lib/libc.so.1
> (gdb) bt
> #0  0xff1b6f3c in strlen () from /usr/lib/libc.so.1
> #1  0xff201c20 in _doprnt () from /usr/lib/libc.so.1
> #2  0xff203ba0 in vprintf () from /usr/lib/libc.so.1
> #3  0x19b38 in DebugMessageFunc (level=2, fmt=0x63f38 "Args: %s\n")
>     at debug.c:85
> #4  0x257f0 in ParseConfig (rule=0xffbed588 "config daemon") at parser.c:3309
> #5  0x22164 in ParseRule (rule_file=0xb5808, prule=0xffbef688 "config daemon",
>     inclevel=0) at parser.c:551
> #6  0x219cc in ParseRulesFile (file=0xa2400 "", inclevel=0) at parser.c:250
> #7  0x2bb34 in ReadConfFile () at snort.c:2283
> #8  0x28f00 in SnortMain (argc=1, argv=0xffbefcf4) at snort.c:245
> #9  0x28cd4 in main (argc=1, argv=0xffbefcf4) at snort.c:95
> 
> Odd thing is, using the same config file and a non-debug version of snort--It
> doesn't core.
> 
> Any ideas?
> 
> -----
> Erek Adams
> Nifty-Type-Guy
> TheAdamsFamily.Net
> 
> 
> 
> -------------------------------------------------------
> This SF.NET email is sponsored by: AMD - Your access to the experts
> on Hammer Technology! Open Source & Linux Developers, register now
> for the AMD Developer Symposium. Code: EX8664
> http://www.developwithamd.com/developerlab
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel

-- 
Phil Wood, cpw at ...86...





More information about the Snort-devel mailing list