[prev in list] [next in list] [prev in thread] [next in thread] 

List:       snort-devel
Subject:    Re: [Snort-devel] snort-1.8.4-beta1 (Build 91)
From:       Chris Green <cmg () uab ! edu>
Date:       2002-02-23 4:54:12
[Download RAW message or body]

Houston: We have progress.

There is still a memory trash condition that happens when we need to
make space for the new guys and theres no lil buggers that can be
expired.  What snort ends up doing is nuking 5 when only have a few
left :)

This isn't a perfect fix but it will keep s4 from dying in
unpredicatable ways.

I'm going to commit this to both stable && current; everyone please
test this out, this has been a bug that has been holding up 1.8.4beta2 and
the subsequent 1.8.4 


[Attachment #3 (text/x-patch)]

Index: spp_stream4.c
===================================================================
RCS file: /cvsroot/snort/snort/Attic/spp_stream4.c,v
retrieving revision 1.54.2.6
diff -u -r1.54.2.6 spp_stream4.c
--- spp_stream4.c	21 Feb 2002 05:56:18 -0000	1.54.2.6
+++ spp_stream4.c	23 Feb 2002 04:50:02 -0000
@@ -2439,7 +2439,9 @@
         DebugMessage(DEBUG_STREAM, "Unable to find session\n");
     }
     else
+    {
         DebugMessage(DEBUG_STREAM, "Found session\n");
+    }
 
     return returned;
 }
@@ -2533,11 +2535,19 @@
     }
     else
     {
-        while(mustdie--)
+        while(mustdie-- &&  ubi_trCount(RootPtr) > 1)
         {
             idx = (Session *) ubi_btLeafNode((ubi_btNodePtr)RootPtr);
             DeleteSession(idx, thetime);
         }
+#ifdef DEBUG
+	if(mustdie) {
+	    DebugMessage(DEBUG_STREAM, "Emptied out the stream cache"
+			 "completely mustdie: %d, memusage: %u\n",
+			 mustdie,
+			 stream4_memory_usage);
+	}
+#endif DEBUG
 
         return 0;
     }
@@ -2894,10 +2904,12 @@
     stream_pkt->pkth = 
         calloc(sizeof(SnortPktHeader)+ETHERNET_HEADER_LEN+65536, sizeof(char));
 
-    stream_pkt->pkt = (u_int8_t *)stream_pkt->pkth + sizeof(SnortPktHeader);
-    stream_pkt->eh = (EtherHdr *) stream_pkt->pkt;
-    stream_pkt->iph = (IPHdr *)stream_pkt->pkth + ETHERNET_HEADER_LEN;
-    stream_pkt->tcph = (TCPHdr *)stream_pkt->iph + IP_HEADER_LEN;
+    stream_pkt->pkt = ((u_int8_t *)stream_pkt->pkth) + sizeof(SnortPktHeader);
+    stream_pkt->eh = (EtherHdr *)((u_int8_t *)stream_pkt->pkt);
+    stream_pkt->iph =
+	(IPHdr *)((u_int8_t *)stream_pkt->eh + ETHERNET_HEADER_LEN);
+    stream_pkt->tcph = (TCPHdr *)((u_int8_t *)stream_pkt->iph + IP_HEADER_LEN);
+
     stream_pkt->data = (u_int8_t *)stream_pkt->tcph + TCP_HEADER_LEN;
 
     stream_pkt->eh->ether_type = 0x0800;

-- 
Chris Green <cmg@uab.edu>
To err is human, to moo bovine.

_______________________________________________
Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel

[prev in list] [next in list] [prev in thread] [next in thread]