ndpiReader Segmantaion Fault with latest compiled code #249

u-Map · 2016-08-16T09:30:47Z

Hi,

nDPI 1.8.0-dev-509-4834109
Ubuntu 14.04 LTS
4.2.0-30-generic x86_64

ndpiReader stops with segmentation fault after running for few minutes.

any idea?

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff73b8700 (LWP 23115)]
0x000000000040d983 in ndpi_parse_packet_line_info (ndpi_struct=ndpi_struct@entry=0x66eac0, flow=flow@entry=0x7ffff0121190) at ndpi_main.c:3734
3734 if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) {
(gdb) bt
#0 0x000000000040d983 in ndpi_parse_packet_line_info (ndpi_struct=ndpi_struct@entry=0x66eac0, flow=flow@entry=0x7ffff0121190) at ndpi_main.c:3734
#1 0x000000000041b49b in ndpi_check_http_tcp (flow=0x7ffff0121190, ndpi_struct=0x66eac0) at protocols/http.c:920
#2 ndpi_search_http_tcp (ndpi_struct=0x66eac0, flow=0x7ffff0121190) at protocols/http.c:950
#3 0x000000000040f926 in check_ndpi_tcp_flow_func (ndpi_struct=0x66eac0, flow=0x7ffff0121190, ndpi_selection_packet=0x7ffff73b7988) at ndpi_main.c:3196
#4 0x000000000040ff46 in ndpi_detection_process_packet (ndpi_struct=0x66eac0, flow=flow@entry=0x7ffff0121190, packet=packet@entry=0x7ffff012192e "E",

packetlen=packetlen@entry=2948, current_tick_l=current_tick_l@entry=1471338542784, src=0x7ffff00dace0, dst=0x7ffff00d90c0) at ndpi_main.c:3519

#5 0x00000000004052a4 in packet_processing (ip_offset=, rawsize=, ipsize=2948, iph6=0x0, iph=, vlan_id=0,

time=1471338542784, workflow=0x8aadc0) at ndpi_util.c:488

#6 ndpi_workflow_process_packet (workflow=0x8aadc0, header=header@entry=0x7ffff73b7b40, packet=packet@entry=0x7ffff0121920 "<\025\302\313\035x")

at ndpi_util.c:865

#7 0x0000000000401fa7 in pcap_packet_callback_checked (args=, header=0x7ffff73b7b40, packet=0x7ffff74e9976 "<\025\302\313\035x")

at ndpiReader.c:1144

#8 0x00007ffff7ba19ba in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#9 0x00007ffff7ba5dce in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#10 0x00007ffff7baa0fd in pcap_loop () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#11 0x0000000000403027 in runPcapLoop (thread_id=0) at ndpiReader.c:1196
#12 processing_thread (_thread_id=0x0) at ndpiReader.c:1224
#13 0x00007ffff7986182 in start_thread (arg=0x7ffff73b8700) at pthread_create.c:312
#14 0x00007ffff76b347d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111

(gdb)

Thanks.

The text was updated successfully, but these errors were encountered:

lucaderi · 2016-08-17T10:05:49Z

Do you have a pcap file to use for reproducing the issue?

kYroL01 · 2016-08-17T10:15:32Z

@lucaderi I also noticed this thing. Unfortunately it not happens always and I was not able to reproduce the issue, but seeing the backtrace of @u-Map the problem is in the macros get_u_int16_t.
IMHO we have to re-think macros of type get_u_intXX (X,O) because it might violating the strict aliasing rule in some cases.
What do u think ?

mmanoj · 2016-08-22T19:13:36Z

i got simile like below:
<error:Cannot access memory at address 0x7f486809f186> at ndpiReader.c : 1157
it also point out ndpi_util.c : 1098

I'm try to reproduce it again and arrange pcap if I get the error.

kYroL01 · 2016-08-22T19:20:34Z

Thank you @mmanoj

u-Map · 2016-08-29T06:26:12Z

Extremely sorry for the delay! I've retried it today with latest dev code and still crashing within few seconds / minutes. I'm running it directly from terminal with ./ndpiReader -i eth1

But I cannot reproduce the issue when replaying with pcap taken at the same time. Anyway I've emailed you the pcap.

nDPI 1.8.0-dev-522-7364fcc

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff73b8700 (LWP 22075)]
0x000000000040d983 in ndpi_parse_packet_line_info (ndpi_struct=ndpi_struct@entry=0x66eac0, flow=flow@entry=0x7ffff001ea40) at ndpi_main.c:3734
3734 if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) {
(gdb) bt
#0 0x000000000040d983 in ndpi_parse_packet_line_info (ndpi_struct=ndpi_struct@entry=0x66eac0, flow=flow@entry=0x7ffff001ea40) at ndpi_main.c:3734
#1 0x000000000041b49b in ndpi_check_http_tcp (flow=0x7ffff001ea40, ndpi_struct=0x66eac0) at protocols/http.c:920
#2 ndpi_search_http_tcp (ndpi_struct=0x66eac0, flow=0x7ffff001ea40) at protocols/http.c:950
#3 0x000000000040f936 in check_ndpi_tcp_flow_func (ndpi_struct=0x66eac0, flow=0x7ffff001ea40, ndpi_selection_packet=0x7ffff73b7988) at ndpi_main.c:3196
#4 0x000000000040ff56 in ndpi_detection_process_packet (ndpi_struct=0x66eac0, flow=flow@entry=0x7ffff001ea40, packet=packet@entry=0x7ffff00206fe "E",
packetlen=packetlen@entry=4193, current_tick_l=current_tick_l@entry=1472450291167, src=0x7ffff001f1d0, dst=0x7ffff001f2d0) at ndpi_main.c:3519
#5 0x00000000004052a4 in packet_processing (ip_offset=, rawsize=, ipsize=4193, iph6=0x0, iph=, vlan_id=0,
time=1472450291167, workflow=0x8af320) at ndpi_util.c:488
#6 ndpi_workflow_process_packet (workflow=0x8af320, header=header@entry=0x7ffff73b7b40,
packet=packet@entry=0x7ffff00206f0 "(\317\351\030", <incomplete sequence \313>) at ndpi_util.c:865
#7 0x0000000000401fa7 in pcap_packet_callback_checked (args=, header=0x7ffff73b7b40,
packet=0x7ffff7519086 "(\317\351\030", <incomplete sequence \313>) at ndpiReader.c:1144
#8 0x00007ffff7ba19ba in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#9 0x00007ffff7ba5dce in ?? () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#10 0x00007ffff7baa0fd in pcap_loop () from /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
#11 0x0000000000403027 in runPcapLoop (thread_id=0) at ndpiReader.c:1196
#12 processing_thread (_thread_id=0x0) at ndpiReader.c:1224
#13 0x00007ffff7986182 in start_thread (arg=0x7ffff73b8700) at pthread_create.c:312
#14 0x00007ffff76b347d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb) quit

mmanoj · 2016-08-30T15:03:35Z

@kYroL01 following findings as per my core dump analysis.

Reading symbols from ndpiReader...done.
[New LWP 3527]
[New LWP 3526]
Cannot access memory at address 0xa32017fff275
Cannot access memory at address 0xa32017fff26d
Core was generated by `./ndpiReader -i eth2 -v2'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000000000040fdd3 in ndpi_parse_packet_line_info (ndpi_struct=, flow=0x7fe8312a6972) at ndpi_main.c:3863
3863 packet->line[packet->parsed_lines].ptr = &packet->payload[a + 2];
Current thread is 1 (LWP 3527) bt full
#0 0x000000000040fdd3 in ndpi_parse_packet_line_info (ndpi_struct=, flow=0x7fe8312a6972) at ndpi_main.c:3863
a = 824864767
packet = 0x7fe8312a6b82
end =
#1 0x000000000041d8fb in _org_ndpi_search_http_tcp (ndpi_struct=0x1f48ac0, flow=0x7fe8312664e0) at protocols/http.c:736
packet = 0x7fe8312666f0
filename_start =
#2 0x0000000000000000 in ?? ()
No symbol table info available.
(gdb) frame 0
#0 0x000000000040fdd3 in ndpi_parse_packet_line_info (ndpi_struct=, flow=0x7fe8312a6972) at ndpi_main.c:3863
3863 packet->line[packet->parsed_lines].ptr = &packet->payload[a + 2];
(gdb) next
The program is not being run.
(gdb) n
The program is not being run.
(gdb) list
3858 if(packet->parsed_lines >= (NDPI_MAX_PARSE_LINES_PER_PACKET - 1)) {
3859 return;
3860 }
3861
3862 packet->parsed_lines++;
3863 packet->line[packet->parsed_lines].ptr = &packet->payload[a + 2];
3864 packet->line[packet->parsed_lines].len = 0;
3865
3866 if((a + 2) >= packet->payload_packet_len) {
3867

Note: I'm checking one more code dump to narrow down more findings. Hope this helpful.

kYroL01 · 2016-08-30T15:11:54Z

Thanks.So the issue seem to be in the http parser for the line. I have to check better.

ccfasm · 2016-09-10T13:08:56Z

I also get this error when I run
./ndpiReader -i em2 -v2

kYroL01 · 2016-09-10T17:13:03Z

Now I'm not at home. From Monday I'll fix all of this stuff ;)
Thanks to be patient.

lucaderi · 2016-09-11T19:17:01Z

I have briefly looked at the problem and the code lines do not match. Can you please @ccfasm try to reproduce it with the code in github?

ccfasm · 2016-09-12T01:28:25Z

@lucaderi
[root@localhost example]# ./ndpiReader -i em2 -v2

NOTE: This is demo app to show some nDPI features.
In this demo we have implemented only some basic features
just to show you what you can do with the library. Feel

* free to extend it and send us the patches for inclusion

Using nDPI (1.8.0-dev-533-3cd6456) [1 thread(s)]
Capturing live traffic from device em2...
Running thread 0...
1 UDP 202.4.130.100:53 <-> 219.242.100.152:61344 [proto: 5/DNS][1 pkts/72 bytes][Host: wx.gtimg.com]
2 UDP 192.36.144.22:123 <-> 219.242.100.152:39471 [proto: 9/NTP][1 pkts/90 bytes]
3 UDP 128.138.140.44:123 <-> 219.242.100.152:47206 [proto: 9/NTP][1 pkts/90 bytes]
4 UDP 202.4.130.100:53 <-> 219.242.100.152:49652 [proto: 5/DNS][1 pkts/74 bytes][Host: cl.vd.f.360.cn]
5 TCP 123.183.221.24:80 <-> 219.242.100.152:63085 [proto: 7.60/HTTP.HTTPDownload][9 pkts/3082 bytes][Host: cl.vd.f.360.cn]
6 TCP 182.254.78.140:80 <-> 219.242.100.152:55610 [proto: 7.48/HTTP.QQ][4 pkts/1311 bytes][Host: short.weixin.qq.com]
7 TCP 219.242.100.152:51149 <-> 220.181.91.153:80 [proto: 7/HTTP][2 pkts/638 bytes][Host: s.url.cn]
8 UDP 202.4.130.100:53 <-> 219.242.100.152:50409 [proto: 5/DNS][1 pkts/71 bytes][Host: wx.qlogo.cn]
9 UDP 202.4.130.100:53 <-> 219.242.100.152:63082 [proto: 5/DNS][1 pkts/86 bytes][Host: kuaikan.netmon.360safe.com]
10 TCP 220.181.24.92:80 <-> 219.242.100.152:63086 [proto: 7/HTTP][6 pkts/1107 bytes][Host: kuaikan.netmon.360safe.com]
11 TCP 182.254.104.16:80 <-> 219.242.100.152:55611 [proto: 7/HTTP][6 pkts/3555 bytes][Host: wx.qlogo.cn]
12 UDP [fe80::f839:b7d:b5f4:66a3]:1900 <-> [ff02::c]:49514 [proto: 12/SSDP][1 pkts/208 bytes]
13 UDP 202.4.130.101:53 <-> 219.242.100.152:56811 [proto: 5/DNS][1 pkts/76 bytes][Host: clock.redhat.com]
14 UDP 202.4.130.100:53 <-> 219.242.100.152:34758 [proto: 5/DNS][1 pkts/78 bytes][Host: a.root-servers.net]
15 TCP 219.242.100.23:9795 <-> 43.255.113.230:443 [proto: 64/SSL_No_Cert][6 pkts/1457 bytes]
16 TCP 182.254.78.140:80 <-> 219.242.100.152:55612 [proto: 7.48/HTTP.QQ][4 pkts/1471 bytes][Host: short.weixin.qq.com]
17 UDP [fe80::574:75a9:5362:fc4b]:1900 <-> [ff02::c]:50791 [proto: 12/SSDP][1 pkts/208 bytes]
18 UDP 219.242.100.23:26151 <-> 202.4.130.100:53 [proto: 5/DNS][1 pkts/85 bytes][Host: 111.94.62.42.in-addr.arpa]
19 UDP 219.242.100.23:26151 <-> 202.4.130.101:53 [proto: 5/DNS][1 pkts/85 bytes][Host: 111.94.62.42.in-addr.arpa]
20 UDP 8.8.8.8:53 <-> 219.242.100.23:61379 [proto: 5/DNS][1 pkts/85 bytes][Host: 111.94.62.42.in-addr.arpa]
21 UDP 202.4.130.100:53 <-> 219.242.100.152:57086 [proto: 5/DNS][1 pkts/75 bytes][Host: tieba.baidu.com]
22 UDP 10.10.105.35:12223 <-> 202.4.128.209:12223 [proto: 125/Skype][3 pkts/741 bytes]
23 UDP 219.242.100.23:54863 <-> 202.4.130.101:53 [proto: 5/DNS][1 pkts/85 bytes][Host: 111.94.62.42.in-addr.arpa]
24 UDP 219.242.100.23:54863 <-> 202.4.130.100:53 [proto: 5/DNS][1 pkts/85 bytes][Host: 111.94.62.42.in-addr.arpa]
25 TCP 119.75.222.48:80 <-> 219.242.100.152:31327 [proto: 7/HTTP][6 pkts/1914 bytes][Host: tieba.baidu.com]
26 UDP 8.8.8.8:53 <-> 219.242.100.23:22804 [proto: 5/DNS][1 pkts/85 bytes][Host: 111.94.62.42.in-addr.arpa]
27 TCP 219.242.100.23:39436 <-> 42.62.94.111:443 [proto: 91/SSL][4 pkts/471 bytes][SSL client: 4]
28 UDP 202.120.2.100:123 <-> 219.242.100.152:44252 [proto: 9/NTP][1 pkts/90 bytes]
29 UDP 219.242.100.23:28498 <-> 202.4.130.101:53 [proto: 5/DNS][1 pkts/85 bytes][Host: 8.33.134.120.in-addr.arpa]
30 TCP 120.134.33.8:80 <-> 219.242.100.23:51417 [proto: 7/HTTP][6 pkts/930 bytes][Host: 120.134.33.8]
31 UDP 219.242.100.23:50645 <-> 202.4.130.101:53 [proto: 5/DNS][1 pkts/76 bytes][Host: dns.msftncsi.com]
32 UDP 202.4.130.100:53 <-> 219.242.100.152:53629 [proto: 5.202/DNS.Microsoft][1 pkts/85 bytes][Host: teredo.ipv6.microsoft.com]
33 TCP 219.242.100.23:56455 <-> 211.147.246.139:80 [proto: 7/HTTP][2 pkts/1308 bytes][Host: www.superstat.cn]
34 TCP 219.242.100.23:41962 <-> 121.194.7.189:80 [proto: 7/HTTP][2 pkts/1788 bytes][Host: dorangesource.alicdn.com]
35 UDP 219.242.100.27:59009 <-> 202.4.130.100:53 [proto: 5/DNS][1 pkts/77 bytes][Host: bp.conf2.f.360.cn]
36 UDP 219.242.100.27:65364 <-> 202.4.130.100:53 [proto: 5/DNS][1 pkts/77 bytes][Host: bp.conf2.f.360.cn]
37 UDP 202.4.130.101:53 <-> 219.242.100.152:40227 [proto: 5/DNS][1 pkts/76 bytes][Host: clock.redhat.com]
38 TCP 182.254.78.140:80 <-> 219.242.100.152:55614 [proto: 7.48/HTTP.QQ][4 pkts/1311 bytes][Host: short.weixin.qq.com]
39 TCP 182.254.78.140:80 <-> 219.242.100.152:55615 [proto: 7.48/HTTP.QQ][4 pkts/1295 bytes][Host: short.weixin.qq.com]
40 TCP 219.242.100.23:9822 <-> 194.158.92.211:443 [proto: 64/SSL_No_Cert][6 pkts/1352 bytes]
41 TCP 182.254.104.16:80 <-> 219.242.100.152:55616 [proto: 7/HTTP][6 pkts/2826 bytes][Host: wx.qlogo.cn]
42 TCP 219.242.100.23:48229 <-> 117.27.142.39:8421 [proto: 17/Syslog][1 pkts/162 bytes]
43 TCP 219.242.100.23:54536 <-> 120.27.130.168:80 [proto: 7/HTTP][2 pkts/884 bytes][Host: bifen4pc.qiumibao.com]
44 UDP [fe80::2139:7ed5:1c91:52f1]:547 <-> [ff02::1:2]:546 [proto: 103/DHCPV6][1 pkts/157 bytes]
45 UDP 202.4.130.100:53 <-> 219.242.100.152:50567 [proto: 5/DNS][1 pkts/77 bytes][Host: s.conf.wsm.360.cn]
46 TCP 219.242.100.152:63087 <-> 220.181.150.242:80 [proto: 7/HTTP][6 pkts/932 bytes][Host: s.conf.wsm.360.cn]
47 UDP 202.4.130.100:53 <-> 219.242.100.152:60678 [proto: 5/DNS][1 pkts/75 bytes][Host: conf.wsm.360.cn]
48 TCP 219.242.100.152:63088 <-> 101.199.103.177:80 [proto: 7/HTTP][6 pkts/2165 bytes][Host: conf.wsm.360.cn]
49 UDP 40.118.103.7:123 <-> 219.242.100.152:39143 [proto: 9/NTP][1 pkts/90 bytes]
50 TCP 219.242.100.152:63089 <-> 101.199.103.177:80 [proto: 7/HTTP][6 pkts/1788 bytes][Host: conf.wsm.360.cn]
51 UDP 74.125.204.139:443 <-> 219.242.100.152:53631 [proto: 188.126/QUIC.Google][1 pkts/1392 bytes][Host: clients1.google.com]
52 UDP 219.242.100.27:65409 <-> 202.4.130.100:53 [proto: 5.202/DNS.Microsoft][1 pkts/85 bytes][Host: teredo.ipv6.microsoft.com]
53 TCP 219.242.100.23:9829 <-> 189.103.27.34:443 [proto: 64/SSL_No_Cert][6 pkts/4224 bytes]
54 UDP 137.189.4.10:123 <-> 219.242.100.152:58023 [proto: 9/NTP][1 pkts/90 bytes]
55 UDP 132.163.4.103:123 <-> 219.242.100.152:42089 [proto: 9/NTP][1 pkts/90 bytes]
56 TCP 221.228.204.21:80 <-> 219.242.100.23:9836 [proto: 7.60/HTTP.HTTPDownload][4 pkts/491 bytes][Host: infoc2.duba.net]
57 TCP 221.228.204.21:80 <-> 219.242.100.23:9837 [proto: 7.60/HTTP.HTTPDownload][4 pkts/491 bytes][Host: infoc2.duba.net]
58 UDP 219.242.100.152:50454 <-> 110.75.186.249:123 [proto: 9/NTP][1 pkts/90 bytes]
59 UDP 210.72.145.44:123 <-> 219.242.100.152:44981 [proto: 9/NTP][1 pkts/90 bytes]
60 UDP 219.242.100.23:33387 <-> 202.4.130.100:53 [proto: 5/DNS][1 pkts/80 bytes][Host: m-adash.m.taobao.com]
61 UDP 8.8.8.8:53 <-> 219.242.100.23:33387 [proto: 5/DNS][1 pkts/80 bytes][Host: m-adash.m.taobao.com]
62 TCP 219.242.100.23:40870 <-> 140.205.163.83:80 [proto: 7.60/HTTP.HTTPDownload][4 pkts/1698 bytes][Host: m-adash.m.taobao.com]
63 UDP 219.242.100.65:68 <-> 255.255.255.255:67 [proto: 18/DHCP][1 pkts/342 bytes]
64 UDP 219.242.100.1:67 <-> 219.242.100.65:68 [proto: 18/DHCP][1 pkts/350 bytes]
65 UDP [fe80::9da3:549f:f47d:7dd7]:5355 <-> [ff02::1:3]:65379 [proto: 154/LLMNR][1 pkts/84 bytes][Host: wpad]
66 UDP 149.20.64.28:123 <-> 219.242.100.152:36263 [proto: 9/NTP][1 pkts/90 bytes]
67 UDP 202.4.130.101:53 <-> 219.242.100.152:50789 [proto: 5/DNS][1 pkts/76 bytes][Host: clock.redhat.com]
68 UDP 202.4.130.100:53 <-> 219.242.100.152:52625 [proto: 5/DNS][1 pkts/69 bytes][Host: p.qpic.cn]
69 UDP 219.242.100.65:137 <-> 219.242.100.255:137 [proto: 10/NetBIOS][1 pkts/92 bytes]
70 TCP 112.90.83.94:80 <-> 219.242.100.152:51151 [proto: 7/HTTP][6 pkts/1067 bytes][Host: p.qpic.cn]
71 TCP 219.242.100.23:52346 <-> 119.75.222.122:443 [proto: 91/SSL][4 pkts/404 bytes][SSL client: pan.baidu.com]
段错误(吐核)

lucaderi · 2016-09-14T22:16:44Z

Can you please create a pcap file that you can share with me and that it can be used to reproduce the crash?

kYroL01 · 2016-09-14T22:32:37Z

@ccfasm From this log you posted is impossible to understand anything.
@u-Map @mmanoj without an example that reproduce the issue is impossible for us to fix the problem, also because I tried to reproduced but no errors occurs. I need more details on which causes the sigfault.

mmanoj · 2016-09-14T22:45:09Z

@kYroL01 I will try new code from github and update you the status. Will try to reproduce the issue. Thank you for the effort.

mmanoj · 2016-09-24T13:45:21Z

@kYroL01 Sorry for the delay, I download latest code today and try to reproduce the error, but couldn't. Will see other people observations.

kYroL01 · 2016-09-24T14:08:53Z

I think the problem is with some http traffic but not easy to reproduce the issue. I'm trying to do it.

mmanoj · 2016-09-24T14:15:32Z

@kYroL01 I will try to get run over large pcap file than live traffic.

osa030 · 2016-09-26T06:20:30Z

Hi,
I also have same problem Live capture .

I think cause the snaplen(=1536) pcap_open_live() argument values.(ndpiReader.c)

To reproduce the files captured with the same value(or more small).

$ sudo tcpdump -i enp0s3 -s 1536 -w crash.pcap

// Web access to various....

$ sudo ndpiReader -i crash.pcap

NOTE: This is demo app to show some nDPI features.
In this demo we have implemented only some basic features
just to show you what you can do with the library. Feel

* free to extend it and send us the patches for inclusion

Using nDPI (1.8.0-dev-547-bf778d6) [1 thread(s)]
Reading packets from pcap file chash.pcap...
Running thread 0...
Segmentation fault

$ sudo gdb ndpiReader ./core
GNU gdb (Ubuntu 7.11.1-0ubuntu1~16.04) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ndpiReader...done.
[New LWP 13166]
[New LWP 13165]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `./ndpiReader -i enp0s3 -dq'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x000000000040e3f5 in ndpi_parse_packet_line_info (ndpi_struct=ndpi_struct@entry=0x211fd60,
flow=flow@entry=0x7f177010ea80) at ndpi_main.c:3715
3715 if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) {
[Current thread is 1 (Thread 0x7f1776558700 (LWP 13166))]

Seems like once you change the value from 1536 to 65535 at the live capture of symptoms no longer occurs.

Attaches a pcap file to reproduce the behavior.
crash.zip

kYroL01 · 2016-09-26T07:58:48Z

@osa030 Thanks for the pcap. I'll check and let you know!

kYroL01 · 2016-09-26T08:49:07Z

I think @osa030 is right and I did the fix 1f807a1

I'm looking for a better solution because I'm reading with kernel >= 3.2 there is dynamic way

I please all of you to do a test and let me know results.
Thank you!

kYroL01 · 2016-09-26T14:38:58Z

So @u-Map @mmanoj @ccfasm I need your tests to see if the issue is fixed.
Thanks

mmanoj · 2016-09-26T18:48:12Z

@kYroL01 thanks for the quick fix, will test and update the result. I was test last time but unable to reproduce it. However will do more test via offline pcap. Thank you for the effort and support.

lucaderi · 2016-09-27T07:00:01Z

I don't think that changing the snaplen is the solution but it's just a way to hide the problem. nDPI should work even with minimal snaplen such as 256. I have found a bug in the same function where previously it was crashing and fixed it. Not sure this is the only problem. I encourage you to test the code more in detail and report.

kYroL01 · 2016-09-27T07:59:48Z

Thanks @lucaderi

kYroL01 · 2016-09-27T19:24:11Z

I think we could consider this issue solved. Open if necessary

mmanoj · 2016-09-28T09:29:49Z

@lucaderi and @kYroL01 Thank you, will update if we able to reproduce or issue appeared again.

leveryd · 2016-12-22T08:24:18Z

still get "segment fault" when i listen on a live interface.
i use 1.8-stable version.

kYroL01 · 2016-12-22T08:35:08Z

@leveryd Really ? Can u reproduce the issue of give us additional information to solve it ?

leveryd · 2016-12-23T01:55:21Z

system information:
Ubuntu 12.04.5 LTS \n \l
linux kernel infrmation:
Linux sec 3.8.0-29-generic #42~precise1-Ubuntu SMP Wed Aug 14 16:19:23 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
i upload "core dump" file as attachment.
core.zip
what any other information u need?

kYroL01 mentioned this issue Aug 27, 2016

ntopng segfault with commit 11fcf54 . ntop/ntopng#712

Closed

kYroL01 added the bug label Aug 30, 2016

kYroL01 added the Testing Needed label Sep 26, 2016

lucaderi added a commit that referenced this issue Sep 27, 2016

Fix for #249 (not sure is enough)

67ac0b4

lucaderi added a commit that referenced this issue Sep 27, 2016

Fix for #249

a0a8c02

kYroL01 closed this as completed Sep 27, 2016

alagoutte pushed a commit to alagoutte/nDPI that referenced this issue Nov 13, 2016

Fix for ntop#249 (not sure is enough)

f6c400a

alagoutte pushed a commit to alagoutte/nDPI that referenced this issue Nov 13, 2016

Fix for ntop#249

7f11a54

Manouchehri mentioned this issue Mar 29, 2017

Segmentation faults due to libpcap? #358

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ndpiReader Segmantaion Fault with latest compiled code #249

ndpiReader Segmantaion Fault with latest compiled code #249

u-Map commented Aug 16, 2016

lucaderi commented Aug 17, 2016

kYroL01 commented Aug 17, 2016 •

edited

Loading

mmanoj commented Aug 22, 2016

kYroL01 commented Aug 22, 2016

u-Map commented Aug 29, 2016

mmanoj commented Aug 30, 2016

kYroL01 commented Aug 30, 2016 •

edited

Loading

ccfasm commented Sep 10, 2016

kYroL01 commented Sep 10, 2016

lucaderi commented Sep 11, 2016

ccfasm commented Sep 12, 2016

lucaderi commented Sep 14, 2016

kYroL01 commented Sep 14, 2016

mmanoj commented Sep 14, 2016

mmanoj commented Sep 24, 2016

kYroL01 commented Sep 24, 2016

mmanoj commented Sep 24, 2016

osa030 commented Sep 26, 2016

kYroL01 commented Sep 26, 2016

kYroL01 commented Sep 26, 2016

kYroL01 commented Sep 26, 2016

mmanoj commented Sep 26, 2016

lucaderi commented Sep 27, 2016

kYroL01 commented Sep 27, 2016 •

edited

Loading

kYroL01 commented Sep 27, 2016

mmanoj commented Sep 28, 2016

leveryd commented Dec 22, 2016

kYroL01 commented Dec 22, 2016

leveryd commented Dec 23, 2016

ndpiReader Segmantaion Fault with latest compiled code #249

ndpiReader Segmantaion Fault with latest compiled code #249

Comments

u-Map commented Aug 16, 2016

lucaderi commented Aug 17, 2016

kYroL01 commented Aug 17, 2016 • edited Loading

mmanoj commented Aug 22, 2016

kYroL01 commented Aug 22, 2016

u-Map commented Aug 29, 2016

mmanoj commented Aug 30, 2016

kYroL01 commented Aug 30, 2016 • edited Loading

ccfasm commented Sep 10, 2016

kYroL01 commented Sep 10, 2016

lucaderi commented Sep 11, 2016

ccfasm commented Sep 12, 2016

* free to extend it and send us the patches for inclusion

lucaderi commented Sep 14, 2016

kYroL01 commented Sep 14, 2016

mmanoj commented Sep 14, 2016

mmanoj commented Sep 24, 2016

kYroL01 commented Sep 24, 2016

mmanoj commented Sep 24, 2016

osa030 commented Sep 26, 2016

* free to extend it and send us the patches for inclusion

kYroL01 commented Sep 26, 2016

kYroL01 commented Sep 26, 2016

kYroL01 commented Sep 26, 2016

mmanoj commented Sep 26, 2016

lucaderi commented Sep 27, 2016

kYroL01 commented Sep 27, 2016 • edited Loading

kYroL01 commented Sep 27, 2016

mmanoj commented Sep 28, 2016

leveryd commented Dec 22, 2016

kYroL01 commented Dec 22, 2016

leveryd commented Dec 23, 2016

kYroL01 commented Aug 17, 2016 •

edited

Loading

kYroL01 commented Aug 30, 2016 •

edited

Loading

kYroL01 commented Sep 27, 2016 •

edited

Loading