Re: Bus error on sparc

[Michael Bell <michael.bell () cms hu-berlin de>]

Michael Bell wrote:
> Hi all,
>
> I debug a little bit with gdb and see that snort always crashs with 
> activated stream4 in decode.c at DecodeUDP line 2329.

Ok, now I have the first such crash without stream4 but I removed 
SPARC_TWIDDLE from stream4 by automatic aligning code. So the crashs are 
much rarer than before.

Is it possible that there is a general alignment problem with p->iph? I 
checked the code and it looks like p->iph is only a reference to pkt + 
ETHERNET_LEN but if a packet includes an ethernet header then the 4-byte 
integer alignment of several architectures is violated because the 
ethernet header length is 14. So a typecast to integer causes a crash.

If there is no other solution then we have to copy the ip packet from 
pkt to iph. I hope there is another solution but I don't see it until now.

Michael
--
-------------------------------------------------------------------
Michael Bell                   Email: michael.bell () cms hu-berlin de
ZE Computer- und Medienservice            Tel.: +49 (0)30-2093 2482
(Computing Centre)                        Fax:  +49 (0)30-2093 2704
Humboldt-University of Berlin
Unter den Linden 6
10099 Berlin                   Email (private): michael.bell () web de
Germany                                       http://www.openca.org



-------------------------------------------------------
Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara
The only event dedicated to issues related to Linux enterprise solutions
www.enterpriselinuxforum.com

_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users