[Snort-users] Bus error on sparc
Andrew R. Baker
andrewb at ...950...
Thu May 15 09:40:14 EDT 2003
Michael Bell wrote:
> I made finally some small fixes in decode.(c|h) and some more fixes in
> spp_stream4.c. I removed SPARC_TWIDDLE from spp_stream4.c and changed
> the code for alignment a little bit.
> Can a more experienced snort developer verify the diffs please? I only
> made some small hacks to fix the bus errors but of course I cannot say
> that I know what I'm doing :)
> Without the patch it is possible to crash snort on sparc with some
> wellformed packets (even if stream4 is not activated).
A better fix may be to do what pcap does for these cases. When
constructing the pseudo packet, offset the start of the packet by N
bytes (where N = number of bytes to make the link layer portion *end* on
a word boundary). I do this in Barnyard for *all* packets regardless of
what platform we are running on
More information about the Snort-users