[Bro] pcap_next Question
Siwek, Jonathan Luke
jsiwek at illinois.edu
Mon May 21 12:45:25 PDT 2012
> So, either
> pcap_next is returning an out of bounds pointer, or something happens
> to data between the point in time when pcap_next returns a values and
> PktSrc::Process calls net_packet_dispatch.
Could be, but then I'd expect a segfault much earlier, at least before NetSessions::DoNextPacket() when the packet data is accessed. In the end, your crash doesn't look related to accessing that data at all, it's an unhandled exception thrown from operator new (failure to allocate memory).
Another possibility could be that since GDB is working with optimized code (the reason why some arguments are "<value optimized out>"), the "out of bounds" indicators don't necessarily indicate a problem yet. If you `./configure --enable-debug` then rebuild/reinstall to disable optimizations, you can see if stack traces for future crashes start reporting valid addresses for the pointer.
More information about the Bro