Home/ Questions/Q 7923833
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-03T17:26:42+00:00

I use a library (libnids) in my program. I call the function nids_run from

  • 0

I use a library (libnids) in my program. I call the function nids_run from the library which continues running until I explicitly call nids_exit.

My program handles SIGINT and calls nids_exit. The interrupt handler returns normally, but sometimes before the library returns the control to my program, I receive a segfault. This is the backtrace GDB gives me:

#0  0x00007ffff6498b2a in ?? () from /usr/lib/libpcap.so.1
#1  0x00007ffff649bee1 in pcap_loop () from /usr/lib/libpcap.so.1
#2  0x00007ffff77bae66 in nids_run () from /usr/lib/libnids.so.1.24
#3  0x0000000000401e92 in main (argc=3, argv=0x7fffffffebf8) at eve.c:139

What is the best strategy to find the problem? Should I somehow debug libpcap?

UPDATE:
As suggetsed by ArjunShankar, I ran my program under Valgrind. This is part of the output:

==7504== Invalid read of size 4
==7504==    at 0x654EDC1: ??? (in /usr/lib/libpcap.so.1.2.1)
==7504==    by 0x6551EE0: pcap_loop (in /usr/lib/libpcap.so.1.2.1)
==7504==    by 0x5250E65: nids_run (in /usr/lib/libnids.so.1.24)
==7504==    by 0x401E91: main (eve.c:139)
==7504==  Address 0x70eece8 is 40 bytes inside a block of size 768 free'd
==7504==    at 0x4C29A9E: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==7504==    by 0x5250DEB: nids_exit (in /usr/lib/libnids.so.1.24)
==7504==    by 0x4026D0: signal_handler (signalhandling.c:17)
==7504==    by 0x5B6313F: ??? (in /lib/libpthread-2.15.so)
==7504==    by 0x5B5FC60: pthread_cond_timedwait@@GLIBC_2.3.2 (in /lib/libpthread-2.15.so)
==7504==    by 0x58E37D4: g_cond_wait_until (in /usr/lib/libglib-2.0.so.0.3200.1)
==7504==    by 0x587E2C0: ??? (in /usr/lib/libglib-2.0.so.0.3200.1)
==7504==    by 0x587E909: g_async_queue_timeout_pop (in /usr/lib/libglib-2.0.so.0.3200.1)
==7504==    by 0x4022D2: analyzer_thread_func (analyzers.c:93)
==7504==    by 0x58CA0C4: ??? (in /usr/lib/libglib-2.0.so.0.3200.1)
==7504==    by 0x5B5BE0D: start_thread (in /lib/libpthread-2.15.so)

More of the output can be found at: http://pastebin.com/93gkSScS

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The Valgrind output shows that libpcap (from inside nids_run) tries to read memory locations after nids_exit frees them:

    e.g.:

    ==7504== Invalid read of size 4
==7504==    at 0x654EDC1: ??? (in /usr/lib/libpcap.so.1.2.1)
==7504==    by 0x6551EE0: pcap_loop (in /usr/lib/libpcap.so.1.2.1)
==7504==    by 0x5250E65: nids_run (in /usr/lib/libnids.so.1.24)

Address 0x70eece8 is 40 bytes inside a block of size 768 free'd
==7504==    at 0x4C29A9E: free
==7504==    by 0x5250DEB: nids_exit (in /usr/lib/libnids.so.1.24)

    So that is a 768 sized block, that is freed in nids_exit, and subsequently read inside nids_run (which apparently has not stopped yet).

    All other errors are similar (nids_exit frees a block, and nids_run continues to try to use it.

    What this means is: You’re either not using libnids (nids_run/nids_exit) correctly, or there is a bug in libnids.

    • 0