[Snort-devel] Bus error with Snort-2.0.6/spo_database.c on Sparc.
weeve at ...2185...
Mon Dec 29 14:57:58 EST 2003
X-Mailer: Sylpheed version 0.9.8claws (GTK+ 1.2.10; i686-pc-linux-gnu)
Content-Type: text/plain; charset=US-ASCII
On Mon, 29 Dec 2003 12:51:00 -0500
"Jim Cervantes" <jcervant at ...2278...> wrote:
> Addresses that generate bus errors when dereferenced are often
> attributable to alignment problems. The underlying machine instruction
> set may have restrictions on how words of certain sizes are accessed.
> Looking at your debugging printf's below, it looks like you bus error'ed
> trying to read p->tcph->th_seq. That's a 32-bit (long word) quantity.
> According to your debugging output, it's aligned to a 16-bit (word)
> boundary (0x24782e). This may explain the problem. Usually these sorts
> of issues are handled relatively transparently by C compilers as padding
> is added to struct memory layouts to maintain alignment restrictions,
> but there are various ways that things can go astray - for instance
> custom memory management or certain build problems. Hope this helps.
I've been seeing this across the whole 2.0.x series using Linux on sparc.
Not sure if this happened pre-2.0.x or not.
Does snort work reliably on other big endian arches?
Also, Paul, what did you use to build snort?
Gentoo/Sparc Team Co-Lead
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 189 bytes
Desc: not available
More information about the Snort-devel