Seg fault about cppip

[mschiffm]

Hi jwinters7, thanks for the bug report. Does cppip work in "packet number" mode? Have you gotten "timestamp" mode to work with different timestamp arguments? What system are you building / running cppip on? Also, any chance I can get to work the pcap in question?

[jwinters7]

No doesn't work in packet number mode either, it writes a little bit of the new.pcap in either mode though. I have tried with different timestamps, and even different pcaps, I starting to think its a bit of a bigger problem. I've even tried it on different machines, I'm running on CentOS Linux release 7.1.1503. With 3.10.0-123.8.1.el7.x86_64 kernel.

Error in messages when trying to use timestamp method:
kernel: cppip[17893]: segfault at 7fffc9f0e000 ip 00007fe754bfc5af sp 00007fffc9f00e28 error 6 in libc-2.17.so[7fe754ab3000+1b6000]

Error in messages when trying to use packet number method:
kernel: traps: cppip-exec[18843] general protection ip:402d92 sp:7fffb921d288 error:0 in cppip-exec[400000+a000]

The pcaps I'm using are about 600MB compressed, if you think its the pcap I will see if I can create some random non live capture data and see how it handles that.

Thanks for your response and help with this.

[mschiffm]

I can't recreate the issue on Debian (wheezy) or OS X 10.11.1. If you can get me the offending pcap (dropbox?) that would help a ton. If that's too unwieldy, perhaps you can recreate with a smaller pcap?

[jwinters7]

Okay, been playing around some more. It does seem to be an issue with certain pcap files, I have one file that it seg faults on when the time window is around 40 seconds. However it works on that same file with a 5 second window.

I know you need the file to be able to really help more, I'm trying to capture something that I can hand out. However I'm currently having issues reproducing the issue outside of our live traffic.

I wanted to keep you updated though, I will post a pcap as soon as I find one I can release.

[mschiffm]

Happy to help but I need more hard data. :)

[mschiffm]

Was able to the crash (big packet, small buffer) -- please pull down the new tree and verify this fixes your issue and I'll close the issue. Thanks!

[jwinters7]

Nice work! Impressed since I gave you almost nothing to work with. Love the commit message too, thanks again.