[Snort-devel] Snort 2.0 cores when http_decode is enabled

Michael Goodman mgoodman at ...1113...
Thu May 15 06:06:10 EDT 2003


Hi,
  I going crazy trying to figure out why snort 2.0 cores when I enable
the http_decode preprocessor.  I'm running snort on FreeBSD 4.7.  Any
help would be appreciated.  Below is the output from gdb.  I attached
the strace as an attachment.

rogram received signal SIGSEGV, Segmentation fault.
0x8066508 in mwmSearchExNoBC (ps=0x9c58000, 
    Tx=0x809c420
"/TWS/CONTENT/TWS/CLASSATT/VIEWCLASSATTBULLETIN.ASP?TEACHERNAME=SININGER,
J&DATE=5/13/2003&BUILDING=20&BUILDINGNAME=GREENE MIDDLE SCHOOL
&BUILDINGLIST=|20|&COURSE=114&COURSENAME=GEN. MUSIC 7 &SECTION=3"...,
n=210, 
    Tc=0x81241c0
"/TWS/Content/TWS/ClassAtt/viewClassAttBulletin.asp?TeacherName=sininger,
j&Date=5/13/2003&Building=20&BuildingName=greene middle school
&BuildingList=|20|&Course=114&CourseName=gen. music 7 &Section=3"..., 
    match=0x805d6f4 <otnx_match>, data=0x809c2f4) at mwm.c:905
905                   if( patrn->psPatCase[0] == Tc[T-Tx] )
(gdb) bt
#0  0x8066508 in mwmSearchExNoBC (ps=0x9c58000, 
    Tx=0x809c420
"/TWS/CONTENT/TWS/CLASSATT/VIEWCLASSATTBULLETIN.ASP?TEACHERNAME=SININGER,
J&DATE=5/13/2003&BUILDING=20&BUILDINGNAME=GREENE MIDDLE SCHOOL
&BUILDINGLIST=|20|&COURSE=114&COURSENAME=GEN. MUSIC 7 &SECTION=3"...,
n=210, 
    Tc=0x81241c0
"/TWS/Content/TWS/ClassAtt/viewClassAttBulletin.asp?TeacherName=sininger,
j&Date=5/13/2003&Building=20&BuildingName=greene middle school
&BuildingList=|20|&Course=114&CourseName=gen. music 7 &Section=3"..., 
    match=0x805d6f4 <otnx_match>, data=0x809c2f4) at mwm.c:905
#1  0x8066f8d in mwmSearch (pv=0x9c58000, 
    T=0x81241c0
"/TWS/Content/TWS/ClassAtt/viewClassAttBulletin.asp?TeacherName=sininger,
j&Date=5/13/2003&Building=20&BuildingName=greene middle school
&BuildingList=|20|&Course=114&CourseName=gen. music 7 &Section=3"...,
n=210, 
    match=0x805d6f4 <otnx_match>, data=0x809c2f4) at mwm.c:1402
#2  0x8067226 in mpseSearch (pv=0x9c31580, 
    T=0x81241c0
"/TWS/Content/TWS/ClassAtt/viewClassAttBulletin.asp?TeacherName=sininger,
j&Date=5/13/2003&Building=20&BuildingName=greene middle school
&BuildingList=|20|&Course=114&CourseName=gen. music 7 &Section=3"...,
n=210, 
    action=0x805d6f4 <otnx_match>, data=0x809c2f4) at mpse.c:219
#3  0x805da51 in fpEvalPacket (p=0xbfbff59c) at fpdetect.c:869
#4  0x805aa0d in Detect (p=0xbfbff59c) at detect.c:283
#5  0x805a7d4 in Preprocess (p=0xbfbff59c) at detect.c:104
---Type <return> to continue, or q <return> to quit---
#6  0x8055d26 in ProcessPacket (user=0x0, pkthdr=0x81f0b0c,
pkt=0x81f0b1e "")
    at snort.c:595
#7  0x280cfe41 in pcap_read () from /usr/lib/libpcap.so.2
#8  0x280cf98f in pcap_loop () from /usr/lib/libpcap.so.2
#9  0x8056e70 in InterfaceThread (arg=0x0) at snort.c:1518
#10 0x8055c1d in SnortMain (argc=3, argv=0xbfbffb9c) at snort.c:537
#11 0x80556f4 in main (argc=3, argv=0xbfbffb9c) at snort.c:165
(gdb) exit

## Strace output









-------------- next part --------------
A non-text attachment was scrubbed...
Name: strace.out
Type: application/octet-stream
Size: 725951 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20030515/ada9767e/attachment.obj>


More information about the Snort-devel mailing list