[Snort-devel] bus error with 2.7.0.1 on OpenBSD/sparc64

Steven Sturges steve.sturges at ...402...
Mon Nov 5 16:42:15 EST 2007


Hi Markus--

OpenBSD on a sparc, eh?  Never seen that combination before.  :)

Can you try adding a 3rd pad to the SessionHashKey structure
that is defined in preprocessors/stream.h, as follows:

 #if defined(_LP64)
     u_int16_t pad2;
 #endif
     u_int8_t  proto;
+#if defined(_LP64)
+    u_int8_t pad3[3];
+#endif
 } SessionHashKey;

 typedef struct _StreamApplicationData

I think this is a byte alignment issue on the 64bit Sparc architecture.

Let us know if that works.

If it still crashes, can you compile w/ debug enabled and set a
stack trace, your snort.conf, and a pcap?

Cheers.
-steve

Markus Lude wrote:
> Hello,
> snort-2.7.0.1 crashes with a bus error on sparc64 running OpenBSD
> 4.2-current very fast after startup. When using stream5 instead of flow
> and stream4 I didn't have this problem so far.
> 
> (gdb) bt
> #0  0x00000000001938bc in CreateNewSession ()
> #1  0x0000000000190f98 in ReassembleStream4 ()
> #2  0x00000000001454f8 in Preprocess ()
> #3  0x0000000000131a94 in ProcessPacket ()
> #4  0x0000000000131328 in PcapProcessPacket ()
> #5  0x000000004314ba74 in pcap_read (p=0x4653d800, cnt=-59, 
>     callback=0x13125c <PcapProcessPacket>, user=0x0)
>     at /usr/src/lib/libpcap/pcap-bpf.c:154
> #6  0x00000000001380d0 in InterfaceThread ()
> #7  0x00000000001306a4 in SnortMain ()
> #8  0x000000000012e3a0 in main ()
> 
> Regards,
> Markus
> 
> 
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Splunk Inc.
> Still grepping through log files to find problems?  Stop.
> Now Search log events and configuration files using AJAX and a browser.
> Download your FREE copy of Splunk now >> http://get.splunk.com/
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> 




More information about the Snort-devel mailing list