Suricata

The issue seems to me too as related to the threading. The error seems to affect other parts too such as detect-http-method, brian please update the method task too. To be on the safe side, I have added a check in HTP library where we are facing the segv (patch attached).

I have run the engine after modification for 100 times and no segv. I hope you have the patch for bug 21 is already applied to the code.

I'm still seeing this issue I'm going to attach a larger pcap as it appears to take less time to segv with this pcap.

I have applied the patches from this bug along with the patches from bug 21, to both the engine and r63 of htp.

coz@coz-desktop:~/downloads/oisfnew$ ./wirefuzz.pl f="/home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08" -r=/home/coz/downloads/current-all-blah.rules -c=suricata117.yaml
Name "main::wday" used only once: possible typo at ./wirefuzz.pl line 84.
Name "main::isdst" used only once: possible typo at ./wirefuzz.pl line 84.
Name "main::yday" used only once: possible typo at ./wirefuzz.pl line 84.
looping forever or until we have an error
rules file /home/coz/downloads/current-all-blah.rules
rules file /home/coz/downloads/current-all-blah.rules
not fuzzing pcap(s)
/home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08
running ulimit -c unlimited; src/suricata -c suricata117.yaml -r /home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08 -l ./ -s /home/coz/downloads/current-all-blah.rules
exit value 0
we have run with success 1 times
/home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08
running ulimit -c unlimited; src/suricata -c suricata117.yaml -r /home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08 -l ./ -s /home/coz/downloads/current-all-blah.rules
exit value 0
we have run with success 2 times
/home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08
running ulimit -c unlimited; src/suricata -c suricata117.yaml -r /home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08 -l ./ -s /home/coz/downloads/current-all-blah.rules
exit value 0
we have run with success 3 times
/home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08
running ulimit -c unlimited; src/suricata -c suricata117.yaml -r /home/coz/downloads/pcaps/evil-fingers/anon_sid_2002773_2002955_2006394_2002707_2003408_2002957.pcap-fuzz-2009-12-27-07-43-08 -l ./ -s /home/coz/downloads/current-all-blah.rules
exit value 139
core dump found core processesing
warning: Can't read pathname for load map: Input/output error.
core dump
GNU gdb (GDB) 7.0-ubuntu
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/&gt;.
Reading symbols from /home/coz/downloads/oisfnew/src/suricata...
done.
[New Thread 26876]
[New Thread 26874]
[New Thread 26863]
[New Thread 26883]
[New Thread 26878]
[New Thread 26879]
[New Thread 26875]
[New Thread 26884]
[New Thread 26880]
[New Thread 26881]
[New Thread 26882]
[New Thread 26873]
Reading symbols from /usr/lib/libhtp-0.1.so.1...
done.
Loaded symbols for /usr/lib/libhtp-0.1.so.1
Reading symbols from /usr/lib/libpcap.so.0.8...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libpcap.so.0.8
Reading symbols from /usr/local/lib/libpfring.so...
done.
Loaded symbols for /usr/local/lib/libpfring.so
Reading symbols from /usr/lib/libnet.so.1...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libnet.so.1
Reading symbols from /lib/libpthread.so.0...
Reading symbols from /usr/lib/debug/lib/libpthread-2.10.1.so...
done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /usr/lib/libyaml-0.so.1...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libyaml-0.so.1
Reading symbols from /lib/libpcre.so.3...
(no debugging symbols found)...done.
Loaded symbols for /lib/libpcre.so.3
Reading symbols from /lib/libc.so.6...
Reading symbols from /usr/lib/debug/lib/libc-2.10.1.so...
done.
(no debugging symbols found)...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/libz.so.1...
(no debugging symbols found)...done.
Loaded symbols for /lib/libz.so.1
Reading symbols from /lib64/ld-linux-x86-64.so.2...
Reading symbols from /usr/lib/debug/lib/ld-2.10.1.so...
done.
(no debugging symbols found)...done.
Loaded symbols for /lib64/ld-linux-x86-64.so.2
Core was generated by `src/suricata -c suricata117.yaml -r /home/coz/downloads/pcaps/evil-fingers/anon'.
Program terminated with signal 11, Segmentation fault.
#0 0x0000000000485562 in DetectHttpCookieMatch (t=0x3d9d760, det_ctx=0x7f24fc000c40, f=0x18a8bc0, flags=4 '', state=0x1524a750, s=0x30b4590, m=0x30b4e70) at detect-http-cookie.c:78
78 if (htp_state>connp->conn == NULL) {
#0 0x0000000000485562 in DetectHttpCookieMatch (t=0x3d9d760, det_ctx=0x7f24fc000c40, f=0x18a8bc0, flags=4 '', state=0x1524a750, s=0x30b4590, m=0x30b4e70) at detect-http-cookie.c:78
co = 0x30b4d90
htp_state = 0x1524a750
ret = 0
tx = 0x7f2508b1ef00
h = 0x1ac48e0
#1 0x00000000004228cb in SigMatchSignaturesAppLayer (th_v=0x3d9d760, de_ctx=0x1ac48e0, det_ctx=0x7f24fc000c40, sgh=0x6892df0, p=0x1806cb0) at detect.c:527
match = 1
fmatch = 0
s = 0x30b4590
sm = 0x30b4e70
idx = 8984
sig = 11913
flags = 4 ''
alstate = 0x1524a750
#2 0x0000000000423260 in SigMatchSignatures (th_v=0x3d9d760, de_ctx=0x1ac48e0, det_ctx=0x7f24fc000c40, p=0x1806cb0) at detect.c:786
match = 0
fmatch = 1
s = 0x319acb0
sm = 0x0
idx = 9672
sig = 12613
#3 0x0000000000423307 in Detect (tv=0x3d9d760, p=0x1806cb0, data=0x7f24fc000c40, pq=0x3d9d860) at detect.c:823
det_ctx = 0x7f24fc000c40
de_ctx = 0x1ac48e0
r = 0
#4 0x00000000004bbdca in TmThreadsSlot1 (td=0x3d9d760) at tm-threads.c:325
tv = 0x3d9d760
s = 0x3d9d830
p = 0x1806cb0
run = 1 ''
r = TM_ECODE_OK
#5 0x00007f250b801a04 in start_thread (arg=<value optimized out>) at pthread_create.c:300
__res = <value optimized out>
pd = 0x7f2508b1f910
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {
139797036398864,
-8962179890314330272,
140736220004960,
0,
0,
3,
9067401624406343520,
9067408372617068384},
mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0,
0x0}, data = {
prev = 0x0, cleanup = 0x0,
canceltype = 0}}}
not_first_call = <value optimized out>
robust = <value optimized out>
#6 0x00007f250b11c7bd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:112
No locals.
#7 0x0000000000000000 in ?? ()