Problem passing a string to a function

Discussion in 'C Programming' started by Shashank, Dec 27, 2007.

  1. Shashank

    Shashank Guest

    Hi,
    I am passing a tcpdump filter to a function which compiles the filter
    using pcap_compile and then sets it.
    Here is the filter,

    ip[12:4]>=0x0000 and ip[12:4] <=0xd9295a3 and ip[16:4] >=0x0000 and
    ip[16:4] <=0x3ca9b416 and tcp[0:2]>=0 and tcp[0:2]<=23923 and
    tcp[2:2]>=0 and tcp[2:2]<=64582 and tcp[2:2]<=655355

    I have many threads passing different filters of a similar form to
    the same function.

    The problem is, 8 out of 10 times, the string gets passed successfully
    and compiled without any problem, but the 2 times, the string gets
    manipulated in a random manner.

    For example, in this case, the filter was passed as

    ip[12:4]>=0x0000 and ip[12:4] <=0xd9295a3 and ip[16:4] >=0x0000 and
    ip[16:4] <=0x3ca9b416 and tcp[0:2]>=0 and tcp[0:2]<=23923 and
    tcp[2:2]>=0 and tcp[2:2]<=64582 tcp[2:2]<=655355

    which of course resulted in pcap_compile raising a syntax error.


    Here is a part of the output for 10 threads:

    ip[12:4]>=0x0000 and ip[12:4] <=0x4e82b543 and ip[16:4] >=0x0000 and
    ip[16:4] <=0x6f835b87 and tcp[0:2]>=0 and tcp[0:2]<=13052 and
    tcp[2:2]>=0 and tcp[2:2]<=14069n
    Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x4e82b543 and
    ip[16:4] >=0x0000 and ip[16:4] <=0x6f835b87 and tcp[0:2]>=0 and
    tcp[0:2]<=13052 and tcp[2:2]>=0 and tcp[2:2]<=14069n: syntax error
    ******************
    PASSED WITHOUT ERROR
    ip[12:4]>=0x4e82b544 and ip[12:4] <=0xffffffff and ip[16:4]
    >=0x6f835b88 and ip[16:4] <=0xffffffff and tcp[0:2]>=13053 and

    tcp[0:2]<=65535 and tcp[2:2]>=14070 and tcp[2:2]<=65535
    ******************
    ip[12:4]>=0x0000 and ip[12:4] <=0xa7997e38 and ip[16:4] >=0x0000 and
    ip[16:4] <=0x7b404ab4 and udp[0:2]>=0 and udp[0:2]<=31630 and
    udp[2:2]>=0 and udp[2:2]<=27845 tcp[2:2]<=65535
    Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0xa7997e38 and
    ip[16:4] >=0x0000 and ip[16:4] <=0x7b404ab4 and udp[0:2]>=0 and
    udp[0:2]<=31630 and udp[2:2]>=0 and udp[2:2]<=27845 tcp[2:2]<=65535:
    syntax error
    ******************
    PASSED WITHOUT ERROR
    ip[12:4]>=0xa7997e39 and ip[12:4] <=0xffffffff and ip[16:4]
    >=0x7b404ab5 and ip[16:4] <=0xffffffff and udp[0:2]>=31631 and

    udp[0:2]<=65535 and udp[2:2]>=27846 and udp[2:2]<=65535
    ******************
    ip[12:4]>=0x0000 and ip[12:4] <=0x48fee779 and ip[16:4] >=0x0000 and
    ip[16:4] <=0xcbdf7c5 and tcp[0:2]>=0 and tcp[0:2]<=24066 and
    tcp[2:2]>=0 and tcp[2:2]<=56142d udp[2:2]<=65535
    Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x48fee779 and
    ip[16:4] >=0x0000 and ip[16:4] <=0xcbdf7c5 and tcp[0:2]>=0 and
    tcp[0:2]<=24066 and tcp[2:2]>=0 and tcp[2:2]<=56142d udp[2:2]<=65535:
    syntax error
    ******************
    PASSED WITHOUT ERROR
    ip[12:4]>=0x48fee77a and ip[12:4] <=0xffffffff and ip[16:4]
    >=0xcbdf7c6 and ip[16:4] <=0xffffffff and tcp[0:2]>=24067 and

    tcp[0:2]<=65535 and tcp[2:2]>=56143 and tcp[2:2]<=655355
    ******************
    ip[12:4]>=0x0000 and ip[12:4] <=0x1e9e35b and ip[16:4] >=0x0000 and
    ip[16:4] <=0x675231ed and tcp[0:2]>=0 and tcp[0:2]<=28481 and
    tcp[2:2]>=0 and tcp[2:2]<=50549 tcp[2:2]<=655355
    Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x1e9e35b and
    ip[16:4] >=0x0000 and ip[16:4] <=0x675231ed and tcp[0:2]>=0 and
    tcp[0:2]<=28481 and tcp[2:2]>=0 and tcp[2:2]<=50549 tcp[2:2]<=655355:
    syntax error
    ******************

    As is evident, the error is pretty random, and mostly toward the end
    of the filter with the occasional "and"s missing..

    Can anyone please confirm that this is indeed a problem with gcc...?
    or are there any particular measures I need to take when passing a
    long string?

    Thanks,
    Shashank
     
    Shashank, Dec 27, 2007
    #1
    1. Advertising

  2. Shashank

    user923005 Guest

    On Dec 26, 4:58 pm, Shashank <> wrote:
    > Hi,
    > I am passing a tcpdump filter to a function which compiles the filter
    > using pcap_compile and then sets it.
    > Here is the filter,
    >
    > ip[12:4]>=0x0000 and ip[12:4] <=0xd9295a3 and ip[16:4] >=0x0000 and
    > ip[16:4] <=0x3ca9b416 and tcp[0:2]>=0 and tcp[0:2]<=23923 and
    > tcp[2:2]>=0 and tcp[2:2]<=64582 and tcp[2:2]<=655355
    >
    > I have many threads passing  different filters of a similar form to
    > the same function.
    >
    > The problem is, 8 out of 10 times, the string gets passed successfully
    > and compiled without any problem, but the 2 times, the string gets
    > manipulated in a random manner.
    >
    > For example, in this case, the filter was passed as
    >
    > ip[12:4]>=0x0000 and ip[12:4] <=0xd9295a3 and ip[16:4] >=0x0000 and
    > ip[16:4] <=0x3ca9b416 and tcp[0:2]>=0 and tcp[0:2]<=23923 and
    > tcp[2:2]>=0 and tcp[2:2]<=64582 tcp[2:2]<=655355
    >
    > which of course resulted in pcap_compile raising a syntax error.
    >
    > Here is a part of the output for 10 threads:
    >
    > ip[12:4]>=0x0000 and ip[12:4] <=0x4e82b543 and ip[16:4] >=0x0000 and
    > ip[16:4] <=0x6f835b87 and tcp[0:2]>=0 and tcp[0:2]<=13052 and
    > tcp[2:2]>=0 and tcp[2:2]<=14069n
    > Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x4e82b543 and
    > ip[16:4] >=0x0000 and ip[16:4] <=0x6f835b87 and tcp[0:2]>=0 and
    > tcp[0:2]<=13052 and tcp[2:2]>=0 and tcp[2:2]<=14069n: syntax error
    > ******************
    > PASSED WITHOUT ERROR
    > ip[12:4]>=0x4e82b544 and ip[12:4] <=0xffffffff and ip[16:4]>=0x6f835b88 and ip[16:4] <=0xffffffff and tcp[0:2]>=13053 and
    >
    > tcp[0:2]<=65535 and tcp[2:2]>=14070 and tcp[2:2]<=65535
    > ******************
    > ip[12:4]>=0x0000 and ip[12:4] <=0xa7997e38 and ip[16:4] >=0x0000 and
    > ip[16:4] <=0x7b404ab4 and udp[0:2]>=0 and udp[0:2]<=31630 and
    > udp[2:2]>=0 and udp[2:2]<=27845 tcp[2:2]<=65535
    > Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0xa7997e38 and
    > ip[16:4] >=0x0000 and ip[16:4] <=0x7b404ab4 and udp[0:2]>=0 and
    > udp[0:2]<=31630 and udp[2:2]>=0 and udp[2:2]<=27845 tcp[2:2]<=65535:
    > syntax error
    > ******************
    > PASSED WITHOUT ERROR
    > ip[12:4]>=0xa7997e39 and ip[12:4] <=0xffffffff and ip[16:4]>=0x7b404ab5 and ip[16:4] <=0xffffffff and udp[0:2]>=31631 and
    >
    > udp[0:2]<=65535 and udp[2:2]>=27846 and udp[2:2]<=65535
    > ******************
    > ip[12:4]>=0x0000 and ip[12:4] <=0x48fee779 and ip[16:4] >=0x0000 and
    > ip[16:4] <=0xcbdf7c5 and tcp[0:2]>=0 and tcp[0:2]<=24066 and
    > tcp[2:2]>=0 and tcp[2:2]<=56142d udp[2:2]<=65535
    > Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x48fee779 and
    > ip[16:4] >=0x0000 and ip[16:4] <=0xcbdf7c5 and tcp[0:2]>=0 and
    > tcp[0:2]<=24066 and tcp[2:2]>=0 and tcp[2:2]<=56142d udp[2:2]<=65535:
    > syntax error
    > ******************
    > PASSED WITHOUT ERROR
    > ip[12:4]>=0x48fee77a and ip[12:4] <=0xffffffff and ip[16:4]>=0xcbdf7c6 and ip[16:4] <=0xffffffff and tcp[0:2]>=24067 and
    >
    > tcp[0:2]<=65535 and tcp[2:2]>=56143 and tcp[2:2]<=655355
    > ******************
    > ip[12:4]>=0x0000 and ip[12:4] <=0x1e9e35b and ip[16:4] >=0x0000 and
    > ip[16:4] <=0x675231ed and tcp[0:2]>=0 and tcp[0:2]<=28481 and
    > tcp[2:2]>=0 and tcp[2:2]<=50549 tcp[2:2]<=655355
    > Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x1e9e35b and
    > ip[16:4] >=0x0000 and ip[16:4] <=0x675231ed and tcp[0:2]>=0 and
    > tcp[0:2]<=28481 and tcp[2:2]>=0 and tcp[2:2]<=50549 tcp[2:2]<=655355:
    > syntax error
    > ******************
    >
    > As is evident, the error is pretty random, and mostly toward the end
    > of the filter with the occasional "and"s missing..
    >
    > Can anyone please confirm that this is indeed a problem with gcc...?
    > or are there any particular measures I need to take when passing a
    > long string?


    The problem is not with GCC. It is a problem in your code. I use GCC
    all the time for multithreading work without incident.
    There are tutorials for libpcap, but I guess you really want
    news:comp.programming.threads. But do be a peach and read their FAQ
    first:
    http://www.lambdacs.com/cpt/FAQ.html
     
    user923005, Dec 27, 2007
    #2
    1. Advertising

  3. Shashank

    Ivan Novick Guest

    On Dec 26, 4:58 pm, Shashank <> wrote:
    - snip -
    > Can anyone please confirm that this is indeed a problem with gcc...?
    > or are there any particular measures I need to take when passing a
    > long string?


    As the other friendly poster said, you haven't provided any evidence
    of an issue with GCC.

    You have two most likely causes for your issue:

    1) Memory corruption in your code or a library you are using.
    2) Improper (or lack there of) locking of memory/resources being
    accessed/modified from multiple threads in your code or a library you
    are using.

    Happy bug hunting.

    Ivan Novick
    http://www.0x4849.net
     
    Ivan Novick, Dec 27, 2007
    #3
  4. Shashank

    Shashank Guest

    On Dec 26, 9:15 pm, Ivan Novick <> wrote:
    > On Dec 26, 4:58 pm, Shashank <> wrote:
    > - snip -
    >
    > > Can anyone please confirm that this is indeed a problem with gcc...?
    > > or are there any particular measures I need to take when passing a
    > > long string?

    THanks a ton! Problem solved..! :)
    Appreciate the help..

    >
    > As the other friendly poster said, you haven't provided any evidence
    > of an issue with GCC.
    >
    > You have two most likely causes for your issue:
    >
    > 1) Memory corruption in your code or a library you are using.
    > 2) Improper (or lack there of) locking of memory/resources being
    > accessed/modified from multiple threads in your code or a library you
    > are using.
    >
    > Happy bug hunting.
    >
    > Ivan Novickhttp://www.0x4849.net
     
    Shashank, Dec 27, 2007
    #4
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Newsgroup - Ann
    Replies:
    5
    Views:
    657
    John Carson
    Jul 30, 2003
  2. James Vanns
    Replies:
    7
    Views:
    7,168
    Evan Carew
    Jan 21, 2004
  3. Foxy Kav
    Replies:
    1
    Views:
    477
    John Carson
    Apr 25, 2004
  4. =?ISO-8859-1?Q?Martin_J=F8rgensen?=
    Replies:
    5
    Views:
    1,338
    =?ISO-8859-1?Q?Martin_J=F8rgensen?=
    May 6, 2006
  5. M.L.

    Problem passing string to function

    M.L., May 6, 2010, in forum: Javascript
    Replies:
    4
    Views:
    219
Loading...

Share This Page