[Oisf-devel] Suricata 1.2.1 + OpenBSD 5.1 = segmentation fault

[Victor Julien]

On 05/07/2012 12:32 PM, Henri Wahl wrote:
> Hi,
> just another thought: when starting Suricata some thousands of error
> message are printed like those:
> 
> [4045] 7/5/2012 -- 12:30:22 - (detect-pcre.c:949) <Warning>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - PCRE JIT compiler
> does not support:
> "/<\s*valitem[^>]*\s(value|name)\s*=\s*([\x22\x27])[^\x22\x27]{104}/i"
> [4045] 7/5/2012 -- 12:30:22 - (detect-pcre.c:949) <Warning>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - PCRE JIT compiler
> does not support: "/^\x2f/smi"
> [4045] 7/5/2012 -- 12:30:22 - (detect-pcre.c:949) <Warning>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - PCRE JIT compiler
> does not support: "/^NLST(?!\n)\s[^\n]{200}/smi"
> [4045] 7/5/2012 -- 12:30:22 - (detect-pcre.c:949) <Warning>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - PCRE JIT compiler
> does not support: "/^LIST(?!\n)\s[^\n]{120}/smi"
> [4045] 7/5/2012 -- 12:30:22 - (detect-pcre.c:949) <Warning>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - PCRE JIT compiler
> does not support: "/^STOR[^\n]+\.asp\x3B\./smi"
> [4045] 7/5/2012 -- 12:30:22 - (detect-pcre.c:949) <Warning>
> (DetectPcreParse) -- [ERRCODE: SC_ERR_PCRE_STUDY(6)] - PCRE JIT compiler
> does not support: "/USER\s*[^\x0d]+\x25\x27/smi"
> 
> Another indication for a PCRE problem?

Could be, although it should fall back to plain pcre (no jit) in this case.

What sid's are producing those warnings?

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------