Project

General

Profile

Actions

Bug #278

closed

Segfault in PktVarFree

Added by Eric Leblond about 13 years ago. Updated about 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

I'm running Suricata on an server. Used version is 1c9e48ae98df7a6a20999458e8173b1e590a5235.

I've encountered crashes after some times in PktVarFree() function.

A backtrace gives the following information:

(gdb) bt
#0  PktVarFree (pv=0x113e1513bb8a31bf) at pkt-var.c:94
#1  0x00000000004b77e3 in TmqhOutputPacketpool (t=<value optimized out>, p=0x8c5be0) at tmqh-packetpool.c:223
#2  0x00000000004b713e in TmThreadsSlotVar (td=<value optimized out>) at tm-threads.c:522
#3  0x00007ffff687f8ba in start_thread () from /lib/libpthread.so.0
#4  0x00007ffff619802d in clone () from /lib/libc.so.6
#5  0x0000000000000000 in ?? ()

The corresponding code is the following:

    pv->name = NULL;
    if (pv->value != NULL) /* line 94 */
        SCFree(pv->value);

After crash

(gdb) print pv->name
Cannot access memory at address 0x113e1513bb8a31bf

It thus looks like, there is a concurrent access problem and that pv is destroyed between the two calls.

Actions

Also available in: Atom PDF