Snort mailing list archives
Re: VRT SO Rule SID: 10127 Causing Segfault on Snort 2.8.5-3
From: Patrick Mullen <pmullen () sourcefire com>
Date: Wed, 7 Apr 2010 11:57:01 -0400
What I've discovered is that after the upgrade, including this shared object rule causes snort to quietly exit with a segmentation fault after just a few seconds:
My first guess is that the shared object Makefile was not updated to reference the correct version of snort. What can happen in this situation is things will build just fine but because things in the SFSnortPacket structure may have moved around, pointers may be located at new places and create a situation where a check for a NULL pointer passes but then the dereferencing of that value ends up out of range and causes the segfault. Please confirm that at the top of the Makefile you have SNORT_VERSION=2.8.5.3 and let me know if you still have problems. Thanks! ~Patrick ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Snort-users mailing list Snort-users () lists sourceforge net Go to this URL to change user options or unsubscribe: https://lists.sourceforge.net/lists/listinfo/snort-users Snort-users list archive: http://www.geocrawler.com/redir-sf.php3?list=snort-users
Current thread:
- VRT SO Rule SID: 10127 Causing Segfault on Snort 2.8.5-3 infosec posts (Apr 07)
- Re: VRT SO Rule SID: 10127 Causing Segfault on Snort 2.8.5-3 Nigel Houghton (Apr 07)
- Re: VRT SO Rule SID: 10127 Causing Segfault on Snort 2.8.5-3 infosec posts (Apr 07)
- Re: VRT SO Rule SID: 10127 Causing Segfault on Snort 2.8.5-3 Patrick Mullen (Apr 07)
- Re: VRT SO Rule SID: 10127 Causing Segfault on Snort 2.8.5-3 Nigel Houghton (Apr 07)