[Oisf-devel] LuaJIT running out of memory causing Suricata crashes?

Chris Wakelin c.d.wakelin at reading.ac.uk
Tue Dec 10 16:48:08 UTC 2013

On 10/12/13 14:28, Victor Julien wrote:
>> I'm still getting crashes on git master - perhaps not so many, e.g.:
>>> [9392] 6/12/2013 -- 15:37:07 - (detect-luajit.c:290) <Info> (DetectLuajitMatchBuffer) -- failed to run script: not enough memory
>> Is it worth putting in that "return 0;" after "SCLogInfo("failed to run
>> script: %s", lua_tostring(tluajit->luastate, -1));" again?
> No I actually think that was a bad idea. It would leave the lua stack
> "dirty" I believe.
> Not really sure how to debug this issue. Are you able to reproduce it on
> a pcap? Or does it only happen after some time?

Alas no pcap. It seems load related, and only after some time. I
wondering whether there may be a thread-safety issue too. E.g. the
students went 00:00-15:30 without crashing today, but crashed twice
yesterday evening. The campus network one was fine this morning but has
crashed twice this afternoon.

I wonder whether I can manage to load lots of zips with a Java useragent
simultaneously and see if that crashes it. Or maybe it's malformed zips ...

Best Wishes,

Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 2908
Whiteknights, Reading, RG6 6AF, UK              Fax: +44 (0)118 975 3094

More information about the Oisf-devel mailing list