[Bro] pcap_next Question

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon May 21 12:45:25 PDT 2012


> So, either
> pcap_next is returning an out of bounds pointer, or something happens
> to data between the point in time when pcap_next returns a values and
> PktSrc::Process calls net_packet_dispatch.

Could be, but then I'd expect a segfault much earlier, at least before NetSessions::DoNextPacket() when the packet data is accessed.  In the end, your crash doesn't look related to accessing that data at all, it's an unhandled exception thrown from operator new[] (failure to allocate memory).

Another possibility could be that since GDB is working with optimized code (the reason why some arguments are "<value optimized out>"), the "out of bounds" indicators don't necessarily indicate a problem yet.  If you `./configure --enable-debug` then rebuild/reinstall to disable optimizations, you can see if stack traces for future crashes start reporting valid addresses for the pointer.

+Jon



More information about the Bro mailing list