[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: weird error messages

On Fri 09 Feb 2001, Phil Carmody wrote:

> These look as if, given a map file, they ought to be simple to find and fix, without necessarily understanding the what the code does (assuming the Trap gives you enough information where to look in a map file). It sounds like the kind of 'black box debugging' that I've done for the last year or so (don't tell my boss I still don't understand what the code does).

Actually, given a binary compiled with -g (and not stripped ;-)
gdb will show exactly which line in which source file is causing
the trap; take the first hex number such from:

snort(25221): unaligned trap at 000000012000e870: 000000012006a41a 28 17

and in gdb:
    list *0x12000e870
will show the segment of source.

> >From your analysis it appears there are 2 solutions.
> 1) Create an copy of the bytes in a way that a simple ->member access can read without trapping.

That's usually the easiest, which means the least changes in the
original source. And that's what I've done :-)

> 2) Supply unaligned read/write (inline) functions/macros
> Something along the lines of
> #define READ_8U(addr) \
>    (*((addr)&~7)>>(((addr)&7)<<3) | \
>    (*((addr&~7)+1)<<(64-((addr)&7)<<3))

Ouch :-)
This would mean quite a lot of changes in the average source,

> These could be used to replace
> u64 key = pPacket->key; /* unaligned trap */
> with 
> u64 key = READ_8U(&pPacket->key); /* safe */

In snort, the lines are of the form:

    ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);

where iph points to a not-aligned struct.

> Do such inline function/macro definitions already exist somewhere (I find it very hard to believe they don't)? If so, then we're already armed with all the tools we need - perhaps one weekend we should all just grab a package and fix a trap each!

I think the kernel has them :-)

Actually, most packages by now are reasonably well-behaved;
it's basically the new ones that haven't been audited by
me or Chris :-)

PS: could you wrap your lines at about 70 chars? It makes
quoting relevant pieces much easier; now I have to quote
the whole paragraph...  And delete non-relevant part...

Paul Slootman
home:       paul@wurtel.net      http://www.wurtel.demon.nl/
work:       paul@murphy.nl       http://www.murphy.nl/
debian:     paul@debian.org      http://www.debian.org/
isdn4linux: paul@isdn4linux.org  http://www.isdn4linux.org/

Reply to: