[Snort-users] Bus error on sparc

Andrew R. Baker andrewb at ...950...
Thu May 15 09:40:14 EDT 2003


Michael Bell wrote:
> Hi,
> 
> I made finally some small fixes in decode.(c|h) and some more fixes in 
> spp_stream4.c. I removed SPARC_TWIDDLE from spp_stream4.c and changed 
> the code for alignment a little bit.
> 
> Can a more experienced snort developer verify the diffs please? I only 
> made some small hacks to fix the bus errors but of course I cannot say 
> that I know what I'm doing :)
> 
> Without the patch it is possible to crash snort on sparc with some 
> wellformed packets (even if stream4 is not activated).

A better fix may be to do what pcap does for these cases.  When 
constructing the pseudo packet, offset the start of the packet by N 
bytes (where N = number of bytes to make the link layer portion *end* on 
a word boundary).  I do this in Barnyard for *all* packets regardless of 
what platform we are running on

-Andrew






More information about the Snort-users mailing list