[Snort-users] Snort Processes randonly dies

Hui Cao hcao at ...1935...
Mon Mar 4 16:49:00 EST 2013


1) make clean
2) ./configure  --enable-64bit-gcc --enable-inline-init-failopen
--enable-ipv6 --enable-mpls --enable-targetbased --enable-zlib
--enable-active-response --enable-normalizer --enable-reload
--enable-ppm --enable-dynamicplugin --enable-perfprofiling
--enable-react --enable-flexresp3 --enable-gre --enable-sourcefire
3) make
4) make install

On Mon, Mar 4, 2013 at 4:27 PM, Avery Rozar
<Avery.Rozar at ...16118...> wrote:
> Ok, thank for your answer. How do I rebuild the config? Is it as simple as  re doing the ./configure&&make&&make install with out the debug option? I think if I remember correctly, I may need to use a make clean or something.
> ________________________________________
> From: Hui Cao [hcao at ...1935...]
> Sent: Monday, March 04, 2013 2:05 PM
> To: Avery Rozar
> Cc: snort-users at lists.sourceforge.net
> Subject: Re: [Snort-users] Snort Processes randonly dies
>
> Unfortunately, this buff is fixed in the current release. SafeMemcpy
> checks the buff size before writing into it. When size of greater than
> allocated buffer size, it will return fail. When your snort is a debug
> build, this will fatal error.  SafeMemcpy is used in many places,
> typically for logging.  We want to limit the memory usage for logging,
> therefore those logging buffer might trigger this assertion.
>
> Best,
> Hui.
>
> I
> On 03/04/2013 07:53 AM, Avery Rozar wrote:
>> Hello Hui,
>> When you refer to the buffer, is this something that should be tweaked? The config file and sysconf file doesn't seem to have anything about a buffer. I used the following config options.
>>
>> --enable-64bit-gcc --enable-inline-init-failopen --enable-ipv6 --enable-mpls --enable-targetbased --enable-zlib --enable-active-response --enable-normalizer --enable-reload --enable-ppm --enable-debug  --enable-dynamicplugin --enable-perfprofiling --enable-react --enable-flexresp3 --enable-gre --enable-sourcefire
>>
>> Thank you,
>> Avery Rozar
>>
>> ________________________________________
>> From: Hui Cao [hcao at ...1935...]
>> Sent: Friday, March 01, 2013 2:41 PM
>> To: Avery Rozar
>> Cc: snort-users at lists.sourceforge.net
>> Subject: Re: [Snort-users] Snort Processes randonly dies
>>
>> Can you provide the reproduction steps? What command and arguments you
>> used? What's the config file?
>>
>> This issue indicates the buffer isn't sufficient to hold the
>> additional data or other errors. If you compiled snort without
>> enabling debug, you shouldn't have this error.
>>
>> Best,
>> Hui.
>>
>> On Fri, Mar 1, 2013 at 2:12 PM, Avery Rozar
>> <Avery.Rozar at ...16118...> wrote:
>>> Has anyone ran into this issue?
>>>
>>> The error I get on the terminal is
>>>
>>> snort: ../include/snort_bounds.h:98: SafeMemcpy: Assertion '0==1' failed
>>>
>>> Any the snort process dies. Using CentOS 6.3, and Snort 2.9.4.
>>>
>>>
>>> Thank you.
>>>
>>> ------------------------------------------------------------------------------
>>> Everyone hates slow websites. So do we.
>>> Make your web apps faster with AppDynamics
>>> Download AppDynamics Lite for free today:
>>> http://p.sf.net/sfu/appdyn_d2d_feb
>>> _______________________________________________
>>> Snort-users mailing list
>>> Snort-users at lists.sourceforge.net
>>> Go to this URL to change user options or unsubscribe:
>>> https://lists.sourceforge.net/lists/listinfo/snort-users
>>> Snort-users list archive:
>>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>>
>>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>




More information about the Snort-users mailing list