Re: weird error messages
On Fri 09 Feb 2001, Phil Carmody wrote:
> These look as if, given a map file, they ought to be simple to find and fix, without necessarily understanding the what the code does (assuming the Trap gives you enough information where to look in a map file). It sounds like the kind of 'black box debugging' that I've done for the last year or so (don't tell my boss I still don't understand what the code does).
Actually, given a binary compiled with -g (and not stripped ;-)
gdb will show exactly which line in which source file is causing
the trap; take the first hex number such from:
snort(25221): unaligned trap at 000000012000e870: 000000012006a41a 28 17
and in gdb:
list *0x12000e870
will show the segment of source.
> >From your analysis it appears there are 2 solutions.
> 1) Create an copy of the bytes in a way that a simple ->member access can read without trapping.
That's usually the easiest, which means the least changes in the
original source. And that's what I've done :-)
> 2) Supply unaligned read/write (inline) functions/macros
> Something along the lines of
> #define READ_8U(addr) \
> (*((addr)&~7)>>(((addr)&7)<<3) | \
> (*((addr&~7)+1)<<(64-((addr)&7)<<3))
Ouch :-)
This would mean quite a lot of changes in the average source,
IMHO.
> These could be used to replace
> u64 key = pPacket->key; /* unaligned trap */
> with
> u64 key = READ_8U(&pPacket->key); /* safe */
In snort, the lines are of the form:
ph.sip = (u_int32_t)(p->iph->ip_src.s_addr);
where iph points to a not-aligned struct.
> Do such inline function/macro definitions already exist somewhere (I find it very hard to believe they don't)? If so, then we're already armed with all the tools we need - perhaps one weekend we should all just grab a package and fix a trap each!
I think the kernel has them :-)
Actually, most packages by now are reasonably well-behaved;
it's basically the new ones that haven't been audited by
me or Chris :-)
PS: could you wrap your lines at about 70 chars? It makes
quoting relevant pieces much easier; now I have to quote
the whole paragraph... And delete non-relevant part...
Paul Slootman
--
home: paul@wurtel.net http://www.wurtel.demon.nl/
work: paul@murphy.nl http://www.murphy.nl/
debian: paul@debian.org http://www.debian.org/
isdn4linux: paul@isdn4linux.org http://www.isdn4linux.org/
Reply to: