Actions
Bug #6109
closedfilterlog crash
Start date:
04/11/2016
Due date:
% Done:
0%
Estimated time:
Plus Target Version:
Release Notes:
Affected Version:
2.2.x
Affected Architecture:
All
Description
filterlog occasionally core dumps (/filterlog.core) since at least 2.2.4 and still does with 2.3 RC.
(gdb) bt #0 0x0000000000402c00 in ?? () #1 0x00000000004034e8 in ?? () #2 0x0000000800a54394 in pcap_platform_finddevs () from /lib/libpcap.so.8 #3 0x0000000800a51752 in pcap_loop () from /lib/libpcap.so.8 #4 0x00000000004031f7 in ?? () #5 0x00000000004011af in ?? () #6 0x0000000800626000 in ?? () #7 0x0000000000000000 in ?? ()
I'd appreciate an identically built binary with -g and that's not stripped to dig further with gdb.
I've built filterlog from your repos in a FreeBSD 10.3-RELEASE VM and by comparing the assembly code I can pinpoint the error to movzbl (%r15),%r12d at 0x402af0 in
filterlog/files/print-tcp.c:194 402aec: 49 8d 47 01 lea 0x1(%r15),%rax 402af0: 45 0f b6 27 movzbl (%r15),%r12d 402af4: 41 83 fc 02 cmp $0x2,%r12d 402af8: 41 be 01 00 00 00 mov $0x1,%r14d 402afe: 73 05 jae 402b05 <tcp_print+0x325> 402b00: 49 89 c5 mov %rax,%r13 402b03: eb 18 jmp 402b1d <tcp_print+0x33d> filterlog/files/print-tcp.c:198 402b05: 44 0f b6 30 movzbl (%rax),%r14d
which corresponds to
opt = *cp++;
if (ZEROLENOPT(opt))
len = 1;
else {
len = *cp++; /* total including type, len */
Updated by Patrik Lundquist almost 10 years ago
No need for a binary with symbols now. Got a nice core dump with my debug build.
#0 0x00000000004044cf in tcp_print (sbuf=0x607928, bp=0x801832344 "�\016�\024��Pg", length=0, bp2=0x801832330 "E") at print-tcp.c:194
194 opt = *cp++;
(gdb) bt full
#0 0x00000000004044cf in tcp_print (sbuf=0x607928, bp=0x801832344 "�\016�\024��Pg", length=0, bp2=0x801832330 "E") at print-tcp.c:194
cp = (const u_char *) 0x901832364 <Address 0x901832364 out of bounds>
...
Updated by Patrik Lundquist almost 10 years ago
I'm working on a fix that I'd like to be included in 2.3.1. It affects all architectures.
Updated by Chris Buechler almost 10 years ago
Thanks Patrik. We're very near release, but if you can get us a fix in the next couple days it should make 2.3.1.
Updated by Chris Buechler over 9 years ago
- Subject changed from filterlog core dump to filterlog crash
- Status changed from New to Resolved
- Target version set to 2.3.1
- Affected Architecture All added
- Affected Architecture deleted (
amd64)
Actions