[Snort-devel] Bus error with Snort-2.0.6/spo_database.c on Sparc.

Jason Wever weeve at ...2185...
Mon Dec 29 14:57:58 EST 2003


X-Mailer: Sylpheed version 0.9.8claws (GTK+ 1.2.10; i686-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Disposition: inline
Content-Transfer-Encoding: 7bit

On Mon, 29 Dec 2003 12:51:00 -0500
"Jim Cervantes" <jcervant at ...2278...> wrote:

> Addresses that generate bus errors when dereferenced are often
> attributable to alignment problems.  The underlying machine instruction
> set may have restrictions on how words of certain sizes are accessed. 
> Looking at your debugging printf's below, it looks like you bus error'ed
> trying to read p->tcph->th_seq.  That's a 32-bit (long word) quantity. 
> According to your debugging output, it's aligned to a 16-bit (word)
> boundary (0x24782e).  This may explain the problem.  Usually these sorts
> of issues are handled relatively transparently by C compilers as padding
> is added to struct memory layouts to maintain alignment restrictions,
> but there are various ways that things can go astray - for instance
> custom memory management or certain build problems.  Hope this helps.

I've been seeing this across the whole 2.0.x series using Linux on sparc. 
Not sure if this happened pre-2.0.x or not.

Does snort work reliably on other big endian arches?

Also, Paul, what did you use to build snort?

-- 
Jason Wever
Gentoo/Sparc Team Co-Lead
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20031229/e3b7d4a3/attachment.sig>


More information about the Snort-devel mailing list