Re: Snort crash when reload rules with tag session

["Carter Waxman (cwaxman)" <cwaxman () cisco com>]

Hello,

Could you please attach a backtrace from gdb?

Thanks,
Carter

From: נתנאל ממן <netanelmaman0 () gmail com<mailto:netanelmaman0 () gmail com>>
Date: Thursday, May 29, 2014 12:29 PM
To: "snort-devel () lists sourceforge net<mailto:snort-devel () lists sourceforge net>" <snort-devel () lists 
sourceforge net<mailto:snort-devel () lists sourceforge net>>
Subject: [Snort-devel] Snort crash when reload rules with tag session


Hello guys, please help me solve a stranger bug.

I have rules with tag session option.
When I'm reload conf via control socket the conf reload succesfully but crash one second after.
When i reload the same rule without tag option, snort reload successfully.
I think that snort free some important struct of tags, but i dont find which and where.

The version of Snort you're running:
2.9.6.1

Information on the rules you have enabled:
General local rule with "tag:session,100,seconds;"

How Snort was built:
configure --enable-control-socket
make

Did you build from source:
Yes

Platform information:
Centos 6.3 x86_64, kernel 2.6.32, intel 86

Any output that may be helpful:
gdb show that crash occur when call to log function after check tagging func in decode.c . Im faild to understand why.

Thanks about your amazing work,

net

------------------------------------------------------------------------------
Time is money. Stop wasting it! Get your web API in 5 minutes.
www.restlet.com/download
http://p.sf.net/sfu/restlet

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!