Project

General

Profile

Actions

Bug #3820

closed

ssh: invalid use to 'AppLayerResult::incomplete`

Added by Victor Julien over 3 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

[1920] 9/7/2020 -- 06:56:24 - (suricata.c:2297) <Notice> (PostRunStartedDetectSetup) -- Signature(s) loaded, Detect thread(s) activated.
suricata: app-layer-parser.c:1257: AppLayerParserParse: Assertion `!(res.needed + res.consumed < input_len)' failed.
Aborted (core dumped)

(gdb) f 4
#4  0x000055c2e8fcb49e in AppLayerParserParse (tv=0x6120000a9840, alp_tctx=0x6190000af080, f=0x61300098c1c0, alproto=5, flags=8 '\b', input=0x61d0015fb8a7 "", input_len=988) at app-layer-parser.c:1257
1257                BUG_ON(res.needed + res.consumed < input_len);
(gdb) p res
$1 = {status = 1, consumed = 6, needed = 84}

2nd time I've seen this, 1st time I was able to catch it. This started happening after the hassh code was merged.


Files

ssh-s101.pcap (13.8 KB) ssh-s101.pcap Victor Julien, 07/10/2020 05:38 AM
Actions

Also available in: Atom PDF