Segfault Snort 2.0.1+ on Alpha EV5

[Michel <michel () endoria net>]

Running snort with the simple args '/sbin/snort -c /etc/snort/snort.conf -l 
/var/log/snort'
causes a segfault. Tried 2.0.1 and 2.0.2beta. Anyone an idea on this?

Thanks,

--
Michel
Endoria Networks




===
Configureline:
./configure --prefix=/usr --bindir=\$$\{exec_prefix\}/sbin 
--mandir=\$$\{exec_prefix\}/share/man --enable-flexresp  --enable-smbalerts 
--without-mysql --without-postgresql --without-openssl

Compiler:
Reading specs from /usr/lib/gcc-lib/alpha-linux/3.0.4/specs
Configured with: ../src/configure -v 
--enable-languages=c,c++,java,f77,proto,objc --prefix=/usr 
--infodir=/share/info --mandir=/share/man --enable-shared --with-gnu-as 
--with-gnu-ld --with-system-zlib --enable-long-long --enable-nls 
--without-included-gettext --disable-checking --enable-threads=posix 
--enable-java-gc=boehm --with-cpp-install-dir=bin --enable-objc-gc alpha-linux
Thread model: posix
gcc version 3.0.4

Platform:
AlphaServer 1000A 5/300 EV5

--snip--

-*> Snort! <*-
Version 2.0.2beta (Build 90)
By Martin Roesch (roesch () sourcefire com, www.snort.org)

Program received signal SIGSEGV, Segmentation fault.
0x12002f640 in otnx_match (id=547238896, index=2, data=0x1200a0940) at 
fpdetect.c:607
607         RULE_NODE        *rnNode = (RULE_NODE*)(pmx->RuleNode);
(gdb) where
#0  0x12002f640 in otnx_match (id=547238896, index=2, data=0x1200a0940) at 
fpdetect.c:607
#1  0x1200330fc in mwmSearchExBC (ps=0x1209e1040, Tx=0x1200a0a68 "ã\024", 
n=25, Tc=0x1201f1e16 "ã\024",
    match=0x12002f5fc <otnx_match>, data=0x1200a0940) at mwm.c:1072
#2  0x120033f3c in mwmSearch (pv=0x1209e1040, T=0x1201f1e16 "ã\024", n=25, 
match=0x12002f5fc <otnx_match>, data=0x1200a0940)
    at mwm.c:1404
#3  0x120034bd0 in mpseSearch (pv=0x1209e1020, T=0x1201f1e16 "ã\024", n=25, 
action=0x12002f5fc <otnx_match>,
    data=0x1200a0940) at mpse.c:219
#4  0x120030450 in fpEvalHeaderSW (port_group=0x12082a800, p=0x11ffff068, 
check_ports=1) at fpdetect.c:966
#5  0x12002fef4 in fpEvalHeaderTcp (p=0x11ffff068) at fpdetect.c:1176
#6  0x12002f804 in fpEvalPacket (p=0x11ffff068) at fpdetect.c:1336
#7  0x120029050 in Detect (p=0x11ffff068) at detect.c:314
#8  0x120028a60 in Preprocess (p=0x11ffff068) at detect.c:117
#9  0x12001efb0 in ProcessPacket (user=0x0, pkthdr=0x11ffff748, 
pkt=0x1201f1de0 "") at snort.c:595
#10 0x200000341b0 in pcap_read () from /usr/lib/libpcap.so.0
#11 0x20000033e3c in pcap_read () from /usr/lib/libpcap.so.0
#12 0x20000035978 in pcap_loop () from /usr/lib/libpcap.so.0
#13 0x120020a24 in InterfaceThread (arg=0x0) at snort.c:1525
#14 0x12001eda8 in SnortMain (argc=5, argv=0x11ffff958) at snort.c:537
#15 0x12001e3f4 in main (argc=5, argv=0x11ffff958) at snort.c:165

(gdb) bt
#0  0x12002f640 in otnx_match (id=547238896, index=2, data=0x1200a0940) at 
fpdetect.c:607
#1  0x1200330fc in mwmSearchExBC (ps=0x1209e1040, Tx=0x1200a0a68 "ã\024", 
n=25, Tc=0x1201f1e16 "ã\024",
    match=0x12002f5fc <otnx_match>, data=0x1200a0940) at mwm.c:1072
#2  0x120033f3c in mwmSearch (pv=0x1209e1040, T=0x1201f1e16 "ã\024", n=25, 
match=0x12002f5fc <otnx_match>, data=0x1200a0940)
    at mwm.c:1404
#3  0x120034bd0 in mpseSearch (pv=0x1209e1020, T=0x1201f1e16 "ã\024", n=25, 
action=0x12002f5fc <otnx_match>,
    data=0x1200a0940) at mpse.c:219
#4  0x120030450 in fpEvalHeaderSW (port_group=0x12082a800, p=0x11ffff068, 
check_ports=1) at fpdetect.c:966
#5  0x12002fef4 in fpEvalHeaderTcp (p=0x11ffff068) at fpdetect.c:1176
#6  0x12002f804 in fpEvalPacket (p=0x11ffff068) at fpdetect.c:1336
#7  0x120029050 in Detect (p=0x11ffff068) at detect.c:314
#8  0x120028a60 in Preprocess (p=0x11ffff068) at detect.c:117
#9  0x12001efb0 in ProcessPacket (user=0x0, pkthdr=0x11ffff748, 
pkt=0x1201f1de0 "") at snort.c:595
#10 0x200000341b0 in pcap_read () from /usr/lib/libpcap.so.0
#11 0x20000033e3c in pcap_read () from /usr/lib/libpcap.so.0
#12 0x20000035978 in pcap_loop () from /usr/lib/libpcap.so.0
#13 0x120020a24 in InterfaceThread (arg=0x0) at snort.c:1525
#14 0x12001eda8 in SnortMain (argc=5, argv=0x11ffff958) at snort.c:537
#15 0x12001e3f4 in main (argc=5, argv=0x11ffff958) at snort.c:165
--snip-- 



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users