[Barnyard-users] Re: Solaris8/Barnyard-beta7 core dump

[ronm <ro...@mi...>]

Andrew,
I applied the patches and it still core dumps with the same error msg. GDB
output follows. Also I had some problems with the patch command so I just
made the changes by hand. I've attached the three altered files after editing so
you can double check that I didn't make a mistake.


# gdb /usr/local/bin/barnyard ./core
GNU gdb 5.0
Copyright 2000 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "sparc-sun-solaris2.8"...
Core was generated by `/usr/local/bin/barnyard -c /etc/snort/barnyard.conf -f
snort.log'.
Program terminated with signal 10, Bus Error.
Reading symbols from /usr/lib/libnsl.so.1...done.
Loaded symbols for /usr/lib/libnsl.so.1
Reading symbols from /usr/lib/libsocket.so.1...done.
Loaded symbols for /usr/lib/libsocket.so.1
Reading symbols from /usr/local/lib/libmysqlclient.so.10...done.
Loaded symbols for /usr/local/lib/libmysqlclient.so.10
Reading symbols from /usr/lib/libc.so.1...done.
Loaded symbols for /usr/lib/libc.so.1
Reading symbols from /usr/lib/libdl.so.1...done.
Loaded symbols for /usr/lib/libdl.so.1
Reading symbols from /usr/lib/libmp.so.2...done.
Loaded symbols for /usr/lib/libmp.so.2
Reading symbols from /usr/lib/libz.so...done.
Loaded symbols for /usr/lib/libz.so
Reading symbols from /usr/lib/libcrypt_i.so.1...done.
Loaded symbols for /usr/lib/libcrypt_i.so.1
Reading symbols from /usr/lib/libgen.so.1...done.
Loaded symbols for /usr/lib/libgen.so.1
Reading symbols from /usr/lib/libm.so.1...done.
Loaded symbols for /usr/lib/libm.so.1
Reading symbols from /usr/local/lib/libgcc_s.so.1...done.
Loaded symbols for /usr/local/lib/libgcc_s.so.1
Reading symbols from /usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1...done.
Loaded symbols for /usr/platform/SUNW,Ultra-5_10/lib/libc_psr.so.1
Reading symbols from /usr/lib/nss_files.so.1...done.
Loaded symbols for /usr/lib/nss_files.so.1
#0  0x19f8c in InsertIPData (op_data=0x37ce8, p=0xffbef690) at op_acid_db.c:406
406             if(snprintf(sql_buffer, MAX_QUERY_SIZE,
(gdb) bt
#0  0x19f8c in InsertIPData (op_data=0x37ce8, p=0xffbef690) at op_acid_db.c:406
#1  0x19ed0 in AcidDbOpLog (context=0x37ce8, data=0x10d8b8) at op_acid_db.c:374
#2  0x176d0 in CallOutputPlugins (list=0x37b98, data=0x10d8b8) at op_plugbase.c:120

#3  0x1df18 in LogDpProcessRecord (data=0x10d8b8, dp=0x3b548) at dp_log.c:229
#4  0x16148 in ProcessSpool (spool_directory=0x3b338 "/var/log/snort",
base_filename=0x3b050 "snort.log",
    first_record=0, timet=1097704) at spool.c:152
#5  0x138a0 in main (argc=5, argv=0xffbefd14) at barnyard.c:115
(gdb)


"Andrew R. Baker" wrote:

> ronm wrote:
> > Andrew,
> > I sent in a problem report on barnyard core dumping a few days ago.
> > Following are more details. All systems are lab boxes so I didn't
>  > bother to sanitize the output.
>
> Can you try the attached patch.  I don't currently have acces to a
> Solaris box to test on, but i think it should work.
>
> -A
>
>   ------------------------------------------------------------------------
>                                         Name: barnyard.patch-2002-06-19-1614.gz
>    barnyard.patch-2002-06-19-1614.gz    Type: application/gzip
>                                     Encoding: base64