[Snort-users] Bus error on sparc

Michael Bell michael.bell at ...9156...
Wed May 14 03:42:07 EDT 2003

Michael Bell wrote:
> Hi all,
> I debug a little bit with gdb and see that snort always crashs with 
> activated stream4 in decode.c at DecodeUDP line 2329.

Ok, now I have the first such crash without stream4 but I removed 
SPARC_TWIDDLE from stream4 by automatic aligning code. So the crashs are 
much rarer than before.

Is it possible that there is a general alignment problem with p->iph? I 
checked the code and it looks like p->iph is only a reference to pkt + 
ETHERNET_LEN but if a packet includes an ethernet header then the 4-byte 
integer alignment of several architectures is violated because the 
ethernet header length is 14. So a typecast to integer causes a crash.

If there is no other solution then we have to copy the ip packet from 
pkt to iph. I hope there is another solution but I don't see it until now.

Michael Bell                   Email: michael.bell at ...9156...
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell at ...5689...
Germany                                       http://www.openca.org

More information about the Snort-users mailing list