Project

General

Profile

Actions
Copy link

Bug #1693

closed
PM AH

Crash on Debian with libpcre 8.35

Bug #1693: Crash on Debian with libpcre 8.35

Added by Peter Manev about 10 years ago. Updated about 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Andreas Herz
Target version:
3.0.1RC1
Affected Versions:
Effort:
Difficulty:
Label:

Description

Details attached.

I can reproduce it consistently(3.0dev (rev 44a444b)) - but dont have the offending pcap yet.

Files

segfault-info (19.8 KB) segfault-info Peter Manev, 02/04/2016 02:37 PM

PM Updated by Peter Manev about 10 years ago Actions
Copy link
 #1

Forgot to mention - I also have a complete core dump - and can share further info if needed.

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
 #2

Please add the steps to reproduce it.

PM Updated by Peter Manev about 10 years ago Actions
Copy link
 #3

In this specific case:

1 - Start suricata with unix socket (-D)
2 - Line up 16K pcaps for reading (through -> /path/to/suricatasc /path/to/socket/socket -c "pcap-file path/to/pcap path/to/log/dir")

EL Updated by Eric Leblond about 10 years ago Actions
Copy link
 #4

  • Assignee set to Eric Leblond

PM Updated by Peter Manev about 10 years ago Actions
Copy link
 #5

  • Subject changed from segfault - unix-socket to segfault - unix-socket (pcre version related)

This crash is not related to either unix socket or Suricata.

We have managed to narrow it down to a reproducible case with a pcap and to pcre 8.35 version - with pcre version 8.38 the issue is not observed.

AH Updated by Andreas Herz about 10 years ago Actions
Copy link
 #6

  • Target version set to 70

Idea from Victor is to add a libpcre check into the configure scripts (like we already have with libhtp).

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
 #8

  • Assignee changed from Eric Leblond to Andreas Herz
  • Target version changed from 70 to 3.0.1RC1

VJ Updated by Victor Julien about 10 years ago Actions
Copy link
 #9

  • Subject changed from segfault - unix-socket (pcre version related) to Crash on Debian with libpcre 8.35
Actions
Copy link

Also available in: PDF Atom