[Snort-devel] [Fwd: Re: [Snort-users] Bus error on sparc]

Michael Bell michael.bell at ...1979...
Wed May 14 08:12:12 EDT 2003


-------- Original Message --------
Subject: Re: [Snort-users] Bus error on sparc
Date: Wed, 14 May 2003 12:40:05 +0200
From: Michael Bell <michael.bell at ...1979...>
To: snort-users at lists.sourceforge.net
References: <3EC08C65.40009 at ...1979...> 
<3EC0FD2A.1000008 at ...1979...> <3EC20C16.6010506 at ...1979...>

Michael Bell wrote:
> Hi all,
> 
> I debug a little bit with gdb and see that snort always crashs with 
> activated stream4 in decode.c at DecodeUDP line 2329.

Ok, now I have the first such crash without stream4 but I removed
SPARC_TWIDDLE from stream4 by automatic aligning code. So the crashs are
much rarer than before.

Is it possible that there is a general alignment problem with p->iph? I
checked the code and it looks like p->iph is only a reference to pkt +
ETHERNET_LEN but if a packet includes an ethernet header then the 4-byte
integer alignment of several architectures is violated because the
ethernet header length is 14. So a typecast to integer causes a crash.

If there is no other solution then we have to copy the ip packet from
pkt to iph. I hope there is another solution but I don't see it until now.

Michael
-- 
-------------------------------------------------------------------
Michael Bell                   Email: michael.bell at ...1979...
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell at ...1980...
Germany                                       http://www.openca.org



-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users at lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users


-- 
-------------------------------------------------------------------
Michael Bell                   Email: michael.bell at ...1979...
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell at ...1980...
Germany                                       http://www.openca.org





More information about the Snort-devel mailing list