[Snort-users] Snort Processes randonly dies

Hui Cao hcao at ...1935...
Mon Mar 4 14:05:27 EST 2013


Unfortunately, this buff is fixed in the current release. SafeMemcpy 
checks the buff size before writing into it. When size of greater than 
allocated buffer size, it will return fail. When your snort is a debug 
build, this will fatal error.  SafeMemcpy is used in many places, 
typically for logging.  We want to limit the memory usage for logging, 
therefore those logging buffer might trigger this assertion.

Best,
Hui.

I
On 03/04/2013 07:53 AM, Avery Rozar wrote:
> Hello Hui,
> When you refer to the buffer, is this something that should be tweaked? The config file and sysconf file doesn't seem to have anything about a buffer. I used the following config options.
>
> --enable-64bit-gcc --enable-inline-init-failopen --enable-ipv6 --enable-mpls --enable-targetbased --enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-ppm --enable-debug  --enable-dynamicplugin --enable-perfprofiling --enable-react --enable-flexresp3 --enable-gre --enable-sourcefire
>
> Thank you,
> Avery Rozar
>
> ________________________________________
> From: Hui Cao [hcao at ...1935...]
> Sent: Friday, March 01, 2013 2:41 PM
> To: Avery Rozar
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Snort Processes randonly dies
>
> Can you provide the reproduction steps? What command and arguments you
> used? What's the config file?
>
> This issue indicates the buffer isn't sufficient to hold the
> additional data or other errors. If you compiled snort without
> enabling debug, you shouldn't have this error.
>
> Best,
> Hui.
>
> On Fri, Mar 1, 2013 at 2:12 PM, Avery Rozar
> <Avery.Rozar at ...16118...> wrote:
>> Has anyone ran into this issue?
>>
>> The error I get on the terminal is
>>
>> snort: ../include/snort_bounds.h:98: SafeMemcpy: Assertion '0==1' failed
>>
>> Any the snort process dies. Using CentOS 6.3, and Snort 2.9.4.
>>
>>
>> Thank you.
>>
>> ------------------------------------------------------------------------------
>> Everyone hates slow websites. So do we.
>> Make your web apps faster with AppDynamics
>> Download AppDynamics Lite for free today:
>> http://p.sf.net/sfu/appdyn_d2d_feb
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest Snort news!





More information about the Snort-users mailing list