[Snort-users] Snort++ crashes abruptly

Russ rucombs at ...589...
Wed Dec 14 10:53:51 EST 2016


If you configure with --enable-debug and run in a debugger you should 
get the full call stack.

On 12/14/16 10:39 AM, João Soares wrote:
> Thanks for your fast reply.
>
> Is there any built-in option that does what you are asking? By stracing
> snort I got these results:
>
> ... (thousands and thousands of nanosleeps)
> nanosleep({0, 1000000}, NULL)           = 0
> nanosleep({0, 1000000}, NULL)           = 0
> nanosleep({0, 1000000}, NULL)           = 0
> nanosleep({0, 1000000}, NULL)           = 0
> nanosleep({0, 1000000}, NULL)           = 0
> nanosleep({0, 1000000}, NULL)           = 0
> nanosleep({0, 1000000},  <unfinished ...>
> +++ killed by SIGABRT +++
>
> Executing snort with -v, doesn't give me any more info other than what I
> already provided:
>
> snort:
> /usr/local/src/snort3/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc:208:
> virtual const StreamBuffer* HttpStreamSplitter::reassemble(Flow*,
> unsigned int, unsigned int, const uint8_t*, unsigned int, uint32_t,
> unsigned int&): Assertion `total <= MAX_OCTETS' failed.
> Aborted
>
> On 12/14/2016 02:23 PM, Russ wrote:
>> Ouch.  Thanks for reporting this.  Can you provide a full backtrace?
>>
>> On 12/14/16 9:15 AM, João Soares wrote:
>>> Hi everyone,
>>>
>>> I've just updated Snort++ to Version 3.0.0-a4 (Build 221) and it is
>>> crashing from time to time. I've collected the following errors:
>>>
>>> AppIdDbg failed to create a related flow for xxx.xx.xx.xx-0 ->
>>> yyy.yy.yy.yy-52094 17
>>>
>>> (The crash does not happen here)
>>>
>>> snort:
>>> /usr/local/src/snort3/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc:208:
>>> virtual const StreamBuffer* HttpStreamSplitter::reassemble(Flow*,
>>> unsigned int, unsigned int, const uint8_t*, unsigned int, uint32_t,
>>> unsigned int&): Assertion `total <= MAX_OCTETS' failed.
>>>
>>> (It crashes here)
>>>
>>> Does anyone have any idea why this is happening? If you need additional
>>> info, please reply, I will provide it ASAP.
>>>
>>> Best regards,
>>> João Soares
>>> ------------------------------------------------------------------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>>> _______________________________________________
>>> Snort-users mailing list
>>> Snort-users at lists.sourceforge.net
>>> Go to this URL to change user options or unsubscribe:
>>> https://lists.sourceforge.net/lists/listinfo/snort-users
>>> Snort-users list archive:
>>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>>
>>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>> _______________________________________________
>> Snort-users mailing list
>> Snort-users at lists.sourceforge.net
>> Go to this URL to change user options or unsubscribe:
>> https://lists.sourceforge.net/lists/listinfo/snort-users
>> Snort-users list archive:
>> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users
>>
>> Please visit http://blog.snort.org to stay current on all the latest Snort news!
>>





More information about the Snort-users mailing list