[Snort-users] Bus error on sparc

Michael Bell michael.bell at ...9156...
Wed May 14 02:29:16 EDT 2003

Hi all,

I debug a little bit with gdb and see that snort always crashs with 
activated stream4 in decode.c at DecodeUDP line 2329.

This is the first time where the function accesses the ip header 
(p->iph->...). The surprising thing is that this code only crashs with 
activated stream4 but stream4 should never access a package which is not 
tcp. So has somebody an idea why stream4 does anything with a udp packet?

I find a function NotForStream4 which checks for an existent tcp header. 
Is it possible that this header is not NULL even if it is a udp packet?

Greetings Michael

P.S. should I ask such questions on snort-devel?
Michael Bell                   Email: michael.bell at ...9156...
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell at ...5689...
Germany                                       http://www.openca.org

More information about the Snort-users mailing list