[Snort-users] snort 1.71 beta 6 exits with bus error signal 10 Freebsd 4.3 beta

Mark Rowlands mark.rowlands at ...752...
Thu Mar 29 13:10:03 EST 2001


On Wednesday 28 March 2001 21:58, Fyodor wrote:
> > preprocessor stream: timeout 30, ports 111 23 80, maxbytes 16384
>
> That's where it pops up :)
>
> > #0  0x2824e591 in memcpy () from /usr/lib/libc.so.4
> > #1  0x8562300 in ?? ()
> > #2  0x8063163 in TcpStreamPacket (p=0xbfbff5fc) at spp_tcp_stream.c:428
> > #3  0x8054e2c in Preprocess (p=0xbfbff5fc) at rules.c:3234
> > #4  0x804b2f9 in ProcessPacket (user=0x0, pkthdr=0x80a1000, pkt=0x80a1012
> > "") at snort.c:479
> > #5  0x280b4849 in pcap_read () from /usr/lib/libpcap.so.2
> > #6  0x280b4537 in pcap_loop () from /usr/lib/libpcap.so.2
> > #7  0x804c5a6 in InterfaceThread (arg=0x0) at snort.c:1359
> > #8  0x804b1e4 in main (argc=15, argv=0xbfbffb94) at snort.c:413
> > a
>
> Hmm.. same place. Could you 'up<enter>up<enter>' so you would be in
> TcpStreamPacket stack frame and then do:
>
> print sptr->s_buf
> print sptr->s_last_byte
> print sptr->c_buf
> print sptr->c_last_byte
>
>
> The patch which I comitted should fix the problem, unless there's something
> else that I missed.

oops...not without finding out how to cvsup backwards..I forgot to back up 
the guilty binary....  I am happy to do so if you want .....but 
Version 1.7.1-beta3 (Build 9)  is cranking along quite happily (and has been 
since wednesday) with the exact  same rule set so it would seem you did the 
right thing. (i  did say so in my mail and point out that the bt was "fyi" so 
please don' t hurt me...........)

Thanks.




More information about the Snort-users mailing list