[Snort-devel] Possible alignment issues with snort 2.1.0 on sparc leading

Erik de Castro Lopo erikd+snort at ...2292...
Tue Dec 30 15:17:01 EST 2003


On Thu, 25 Dec 2003 19:37:56 -0500
Kurt Raschke <kurt at ...2295...> wrote:

> Program received signal SIGBUS, Bus error.
> 0x00017e40 in DecodeTCP (pkt=0x1f3f32 "", len=1480, p=0xeffff6a8)
>     at decode.c:2221
> 2221            ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);

Try finding the address of p->iph->ip_src.s_addr. If it is not int aligned
then that is the cause of your problem.

Obviously there are things like this throughout the code. All solutions
to this problem will result in slower code for some accesses.

Therefore, a complete solution would require the following:

  0) A way to detect at configure/build time whether the host CPU can do
     unaligned accesses.
  1) A macro or inline function for doing an endian neutral unaligned read.
     This macro should default to a standard unaligned read where the host
     CPU can handle it.
  2) Digging through all current code and replacing potential unaligned
     accesses with accesses via the macro/inline function.
  3) All future code also needs to use the macro rather than a direct
     read.

Obviously, the above is a far from trivial matter, especially in terms of
ongoing testing and validation. Would it not just be easier to run Snort
on a platform that allows unaligned accesses?

Erik
-- 
------------------------------------------------------
[N] Erik de Castro Lopo, Senior Computer Engineer
[E] erik.de.castro.lopo at ...2292...
[W] http://www.sensorynetworks.com
[T] +61 2 83022726 
[F] +61 2 94750316 
[A] L4/140 William St, East Sydney NSW 2011, Australia
------------------------------------------------------




More information about the Snort-devel mailing list