Segmentation fault with RuleMatcher

[Yohann Thomas]

Hi everybody !!!

As I explained in a previous mail, I'd like to log information using 
Bro, in particular http payloads for each connection seen on a network.
I was looking for another way than signatures to manage this. Thanks for 
your answers, but finally, I think signatures is not a so bad way to 
handle this, since it can be easily extended to other protocols by just 
changing port numbers in the rules and also because I can format output 
the way I want in a Bro script.

So, let's see the new problem... :-(

At the moment, I use these signatures :

signature http-request {
    ip-proto == tcp
    dst-port == 80
    payload /.*/
    event "http-request"
}

signature http-reply {
    ip-proto == tcp
    src-port == 80
    payload /.*/
    event "http-reply"
    tcp-state responder
}

signature http-effective-request {
    ip-proto == tcp
    dst-port == 80
    payload /.*/
    event "http-effective-request"
    requires-reverse-signature http-reply
}

In fact, I can get events for http-request, http-reply, and 
http-effective-request (which means Bro has effectively matched a 
(request, reply) couple).
Then, here is the way I manage the data in a Bro script :

event signature_match(state: signature_state, msg: string, data: string)
{
    if (msg == "http-request")
    {
        current_session$req$payload = data;
    }
    if (msg == "http-reply")
    {
        current_session$rep$payload = data;
    }
    if (msg == "http-effective-request")
    {
        current_session$startTime = state$conn$start_time;
        current_session$IP_clt = state$conn$id$orig_h;
        current_session$IP_srv = state$conn$id$resp_h;
        log_info(current_session);
    }
}

where log_info is a function I defined to log info ;-) contained in the 
current_session record.
Moreover, I load http-reply (so http and http-request are also loaded) 
and signatures modules in this script.

Now the results :

On my computer, it works perfectly, but I'm the only one generating http 
traffic... ;-)

But when I launch this on a real probe, I get a "Segmentation Fault" 
after a random time.
I dumped a core, to locate the problem, and it seems to crash in 
RuleMatcher::ExecRule.

So, my question : What's the problem ??? (I know there are better 
questions, but... ;-) )
                              Can it be due to an excessive traffic ???

Other information :
    - Traffic : about 5000 packets/s
    - HTTP traffic only : about 500 packets/s (I use a tcpdump filter to 
limit to this kind of traffic)
    - top command gives me : %CPU = max about 15% and %MEM = max about 3%


Thanks by advance,

Yohann.