[Oisf-devel] Frequent Segfaults in AppLayerProtoDetectPMGetProto with new AppLayer changes

[Chris Wakelin]

On 17/01/14 10:54, Victor Julien wrote:
> On 01/16/2014 01:35 PM, Chris Wakelin wrote:
>> I tried yesterday's git master - 2.0dev (rev 06f9b0a) - on the student
>> network yesterday. It crashed four times in two hours with:
>>
>> Program terminated with signal 11, Segmentation fault.
>> #0  AppLayerProtoDetectPMGetProto (pm_results=0x7f339e67cf20,
>>     ipproto=6 '\006', direction=<optimised out>, buflen=972,
>>     buf=0x7f339e67d8d0 "\005\002\005", tctx=0x7f341466cdc0, f=<optimised
>> out>)
>>     at app-layer-detect-proto.c:1660
>>
>> (full backtrace attached - I've got three other very similar ones).
>>
>> I kept the same suricata.yaml as I was using for 2.0beta2. I've switched
>> back to 2.0beta2 for now.
>>
>> Let me know if you need any more details. I still have the core files,
>> but they're huge :-)
> 
> I just pushed a fix to an issue in this code. Could you try the current
> master?
> 

Thanks! That seems to have fixed it - no more crashes of that kind in
the last 24 hours. I'm still getting the occasional LuaJIT crashes
without core dumps though: "(DetectLuajitMatchBuffer) -- failed to run
script: not enough memory"

Best Wishes,
Chris

-- 
--+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+-
Christopher Wakelin,                           c.d.wakelin at reading.ac.uk
IT Services Centre, The University of Reading,  Tel: +44 (0)118 378 8439
Whiteknights, Reading, RG6 2AF, UK              Fax: +44 (0)118 975 3094