Re: Snort-1.8.1-beta3 tarball available at snort.org

[Steve Williams <intsteve () genie96 com>]

Hi,

I got a core dump with Snort-1.8.1-beta3, running on OpenBSD 2.6.  It
ran about 12 hours or so..

I'll keep the core file around in case anyone wants more info from
it...I deleted the email earlier that had the information that was
requested from the core dump.

Here's what I got anyway...

# gdb snort snort.core

This GDB was configured as "i386-unknown-openbsd2.6"...
Core was generated by `snort'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/libexec/ld.so...done.
Reading symbols from /usr/lib/libpcap.so.1.0...done.
Reading symbols from /usr/lib/libm.so.0.1...done.
Reading symbols from /usr/local/lib/libssl.so.2.1...done.
Reading symbols from /usr/local/lib/libcrypto.so.2.1...done.
Reading symbols from /usr/lib/libc.so.23.1...done.
#0  0x38cf6 in Rotate (p=0x50aa0) at ubi_SplayTree.c:212
212         parentp->Link[(int)way] = tmp;
(gdb) print parentp
$1 = 0x399cc
(gdb) print *parentp
$2 = {Link = {0x53e58955, 0x8b085d8b, 0x518b0c4d}, gender = 16 '\020',
balance = -117 '\213'}
(gdb) print *parentp->Link
$3 = (struct ubi_btNodeStruct *) 0x53e58955
(gdb) print *parentp->Link[0]
Cannot access memory at address 0x53e58955.
(gdb)
--------------------------------------------------------------------
(gdb) bt
#0  0x38cf6 in Rotate (p=0x50aa0) at ubi_SplayTree.c:212
#1  0x38d56 in Splay (SplayWithMe=0x50aa0) at ubi_SplayTree.c:252
#2  0x38de0 in ubi_sptRemove (RootPtr=0x50aa0, DeadNode=0x50aa0) at
ubi_SplayTree.c:346
#3  0x3dcbd in DeleteSession (ssn=0x50aa0, time=995711078)  at
spp_stream4.c:2211
#4  0x3e23f in PruneSessionCache (thetime=995711078, mustdie=0) at
spp_stream4.c:2392
#5  0x3b9ae in ReassembleStream4 (p=0xdfbfd758) at spp_stream4.c:1257
#6  0x119db in Preprocess (p=0xdfbfd758) at rules.c:3427
#7  0x21b5 in ProcessPacket (user=0x0, pkthdr=0x99000, pkt=0x99012 "")
at snort.c:512
#8  0x40065261 in pcap_read ()
#9  0x4006fc67 in pcap_loop ()
#10 0x4bce in InterfaceThread (arg=0x0) at snort.c:1441
#11 0x20a4 in main (argc=8, argv=0xdfbfdcf0) at snort.c:445
(gdb)

Martin Roesch wrote:

> For those of you without CVS access:
>
> http://www.snort.org/files/snort-1.8.1-beta3.tar.gz
>
>      -Marty
>
> --
> Martin Roesch
> roesch () sourcefire com
> http://www.sourcefire.com - http://www.snort.org
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> http://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
http://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users