Another segv in ArgusCreateIPv4Flow?

[Carter Bullard]

Hey Jonathan,
Thanks!!!!!!    When I release the new clients,
I'll push a minor update for argus() that has the patch in it.

Sorry for the inconvenience,

Carter

On Feb 24, 2009, at 10:05 AM, Jonathan Towne wrote:

> Carter,
>
> For what its worth; I had to use this patch on an OpenBSD 4.4/amd64  
> machine
> when monitoring a gif(4) interface for a VPN.. Otherwise, identical  
> crash.
>
> (Using 3.0.0 from the FTP as of last night)
>
> -- Jonathan Towne
>
>
> On Fri, Jul 18, 2008 at 11:15:28AM -0400, Carter Bullard scribbled:
> # Hey David,
> # Lots of questions to ask, like the machine, architecture (seems like
> # its 64-bit), what kind of interface are you capturing from, and what
> # kind of
> # packets are you expecting?   Normally we'd all need that kind of  
> info,
> # but.....
> #
> # From your gdb dump, I think I see the problem.
> #
> # Looks to me that ArgusProcessIpPacket() is getting good data, but  
> its
> # not updating the ArgusThisIpHdr field in ArgusModel, as this value
> # is empty.
> #
> # Because your line numbers are so pretty far off from my source tree,
> # make this change and tell me if it worked for you.
> #
> # Modify this line in ArgusProcessIpPacket() (+26 lines from the  
> start)
> #
> #       model->ArgusThisUpHdr = (unsigned char *)ip;
> #
> # to
> #       model->ArgusThisIpHdr = (unsigned char *)ip;
> #
> # and lets see if that makes a difference!!!   If so, I'll add it to  
> the
> # argus-3.0.1.beta.1 distibution code.
> #
> # And thanks for sending mail!!!!
> #
> # Carter
> #
> # On Jul 18, 2008, at 6:23 AM, David wrote:
> #
> # >I have just read the earlier thread with a segfault in
> # >ArgusCreateIPv4Flow().  I have modified the code section mentioned
> # >there but I still get the same results.
> # >
> # >I'm no expert with gdb but I managed to compile and grab a
> # >backtrace.  I edited argus/Makefile and replaced the optimisation
> # >with -ggdb, is there a better way to enable debug?
> # >
> # >Below is the backtrace.  In order to share the capture files I'd
> # >have to sanitise out data.  I am happy to debug and play with the
> # >source as necessary though.
> # >
> # >david at fish ~/tmp/argus/argus-3.0.0 $ gdb bin/argus
> # >GNU gdb 6.7.1
> # >Copyright (C) 2007 Free Software Foundation, Inc.
> # >License GPLv3+: GNU GPL version 3 or later
> # ><http://gnu.org/licenses/gpl.html >
> # >This is free software: you are free to change and redistribute it.
> # >There is NO WARRANTY, to the extent permitted by law.  Type "show
> # >copying"
> # >and "show warranty" for details.
> # >This GDB was configured as "i686-pc-linux-gnu"...
> # >Using host libthread_db library "/lib/libthread_db.so.1".
> # >(gdb) run -r /home/david/tmp/test.pcap
> # >Starting program: /home/david/tmp/argus/argus-3.0.0/bin/argus -r /
> # >home/david/tmp/test.pcap
> # >
> # >Program received signal SIGSEGV, Segmentation fault.
> # >0x08055b29 in ArgusCreateIPv4Flow (model=0x8134008, ip=0x0) at
> # >ArgusModeler.c:3632
> # >3632       unsigned char *nxtHdr = (unsigned char *)((char *)ip +
> # >(ip->ip_hl << 2));
> # >(gdb) bt full
> # >#0  0x08055b29 in ArgusCreateIPv4Flow (model=0x8134008, ip=0x0) at
> # >ArgusModeler.c:3632
> # >       retn = (void *) 0x8134418
> # >       nxtHdr = (unsigned char *) 0x10000000 <Address 0x10000000  
> out
> # >of bounds>
> # >       sport = 47097
> # >       dport = 4096
> # >       proto = 0 '\0'
> # >       tp_p = 0 '\0'
> # >       len = 0
> # >       hlen = 0
> # >       ArgusOptionLen = 0
> # >#1  0x08050634 in ArgusCreateFlow (model=0x8134008, ptr=0x813494c,
> # >length=78) at ArgusModeler.c:1555
> # >       retn = (void *) 0x8134418
> # >       ep = (struct ether_header *) 0x813494c
> # >       keys = 1
> # >       index = 1
> # >       i = 0
> # >#2  0x0804fccc in ArgusProcessIpPacket (model=0x8134008,
> # >ip=0x813494c, length=78, tvp=0xbfe4927c) at ArgusModeler.c:1361
> # >       retn = 0
> # >       pass = 1
> # >       flow = (struct ArgusFlowStruct *) 0x1
> # >       nflow = (struct ArgusFlowStruct *) 0xbb
> # >       tflow = (struct ArgusSystemFlow *) 0x0
> # >#3  0x08059992 in ArgusIpPacket (user=0xb7d64008 "", h=0xbfe492ec,
> # >p=0x813494c "E") at ArgusSource.c:1403
> # >       src = (struct ArgusSourceStruct *) 0xb7d64008
> # >       tvpbuf = {tv_sec = 1211532660, tv_usec = 393789}
> # >       tvp = (struct timeval *) 0xbfe4927c
> # >       ip = (struct ip *) 0x813494c
> # >       length = 78
> # >       caplen = 78
> # >       statbuf = {st_dev = 13257796500955894428, __pad1 = 1,
> # >__st_ino = 0, st_mode = 3085275911, st_nlink = 135481676, st_uid =
> # >3086700584, st_gid = 78, st_rdev = 339259832066,
> # > __pad2 = 18764, st_size = 338093555700, st_blksize = 78, st_blocks
> # >= -5195550500855704984, st_atim = {tv_sec = 135480824, tv_nsec =
> # >135481676}, st_mtim = {tv_sec = 78,
> # >   tv_nsec = -1075539304}, st_ctim = {tv_sec = -1209733708, tv_nsec
> # >= 135480824}, st_ino = 335142930764}
> # >#4  0xb7f816ee in pcap_offline_read () from /usr/lib/libpcap.so.0
> # >No symbol table info available.
> # >#5  0xb7fd2650 in _r_debug ()
> # >No symbol table info available.
> # >#6  0x00000001 in ?? ()
> # >No symbol table info available.
> # >#7  0xbfe492f0 in ?? ()
> # >No symbol table info available.
> # >#8  0xb7fc46e9 in _dl_fixup () from /lib/ld-linux.so.2
> # >No symbol table info available.
> # >Backtrace stopped: previous frame inner to this frame (corrupt  
> stack?)
> # >(gdb)
> # >
> # >Regards,
> # >
> # >David
> # >
> # >
> # >
> #
>