[Oisf-users] Thread naming string size src/util-runmodes.c

Victor Julien lists at inliniac.net
Thu Sep 5 13:14:51 UTC 2013


On 08/29/2013 05:10 AM, Tritium Cat wrote:
> If you use PF_RING DNA with AutoFP the interface name exceeds the 12
> character buffer allocated for the thread name and seems to cause all
> threads to overwrite each other resulting in a single capture thread.
> 
> Noticed that the thread name buffer size is inconsistent among the
> various RunModeSetLiveCapture* functions.
> 
> Is there anything wrong with standardizing this buffer size to >= 16
> characters ?
> 
> --TC
> 
> 
> int RunModeSetLiveCaptureAutoFp(DetectEngineCtx *de_ctx,
>                               ConfigIfaceParserFunc ConfigParser,
>                               ConfigIfaceThreadsCountFunc ModThreadsCount,
>                               char *recv_mod_name,
>                               char *decode_mod_name, char *thread_name,
>                               const char *live_dev)
> {
>     char tname[12];   // <<<<<<<< thread name buffer 
>     char qname[12];
>     char queues[2048] = "";
>     int thread;
> 
> 
> Functions:
> 
> src/util-runmodes.c:50:int RunModeSetLiveCaptureAuto(DetectEngineCtx
> *de_ctx,
> src/util-runmodes.c:289:int RunModeSetLiveCaptureAutoFp(DetectEngineCtx
> *de_ctx,
> src/util-runmodes.c:502:static int
> RunModeSetLiveCaptureWorkersForDevice(DetectEngineCtx *de_ctx,
> src/util-runmodes.c:595:int RunModeSetLiveCaptureWorkers(DetectEngineCtx
> *de_ctx,
> src/util-runmodes.c:619:      
>  RunModeSetLiveCaptureWorkersForDevice(de_ctx,
> src/util-runmodes.c:632:int RunModeSetLiveCaptureSingle(DetectEngineCtx
> *de_ctx,
> 
> 
> Inconsistencies:
> 
> $ grep "char tname" suricata-2.0beta1/src/util-runmodes.c
>     char tname[16];
>     char tname[24];   <<<<<<<<< Modified 
>         char tname[20];
>     char tname[16];
>     char tname[16];
>     char tname[16];
> 

Good catch, we should fix up those inconsistencies. The thread name as
we set it in pthreads is supposedly limited to 16 chars though, so
setting it higher *should* have no effect.

-- 
---------------------------------------------
Victor Julien
http://www.inliniac.net/
PGP: http://www.inliniac.net/victorjulien.asc
---------------------------------------------



More information about the Oisf-users mailing list