From owner-freebsd-hackers Mon Oct 20 09:27:21 1997 Return-Path: Received: (from root@localhost) by hub.freebsd.org (8.8.7/8.8.7) id JAA03198 for hackers-outgoing; Mon, 20 Oct 1997 09:27:21 -0700 (PDT) (envelope-from owner-freebsd-hackers) Received: from citadel.cdsec.com (citadel.cdsec.com [192.96.22.18]) by hub.freebsd.org (8.8.7/8.8.7) with ESMTP id JAA03183; Mon, 20 Oct 1997 09:27:06 -0700 (PDT) (envelope-from gram@cdsec.com) Received: (from nobody@localhost) by citadel.cdsec.com (8.8.5/8.6.9) id SAA19702; Mon, 20 Oct 1997 18:36:55 +0200 (SAT) Received: by citadel via recvmail id 19669; Mon Oct 20 18:36:37 1997 by gram.cdsec.com (8.8.5/8.8.5) id SAA11653; Mon, 20 Oct 1997 18:04:36 +0200 (SAT) From: Graham Wheeler Message-Id: <199710201604.SAA11653@cdsec.com> Subject: Re: Bug in 2.2.2 To: jmb@FreeBSD.ORG (Jonathan M. Bresler) Date: Mon, 20 Oct 1997 18:04:35 +0200 (SAT) Cc: hackers@FreeBSD.ORG In-Reply-To: <199710201613.JAA02114@hub.freebsd.org> from "Jonathan M. Bresler" at Oct 20, 97 09:13:23 am X-Mailer: ELM [version 2.4 PL25-h4.1] MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-hackers@FreeBSD.ORG X-Loop: FreeBSD.org Precedence: bulk Hi Jon > can you tell me how to reproduce it within X hours? > if i remember correctly, it was failing every X hours > for you. if its statically linked i can hack on > the shared library and see if i can track this down. > The original problem with the gateway usually occurred within less than an hour, but it certainly wasn't a fixed interval. The Midnight Commander instance happened after the mc had been running for quite some time (possibly since the previous week). The mc and ps instances were noticed at the same time. I now speculate that the problem was within mc, not ps - the ps was probably run from the mc command line, and inherited a corrupt heap from the parent process. I can't provide much more detail than this - the sites where it happened are in different cities, and I am mostly just summarising what was reported to me by the administrators of the various firewalls, and, when I can get them to do it, from looking at core dumps generated with SIGABRT. I will write a small program to exercise the heap, and see if I can replicate the problem at all. -- Dr Graham Wheeler E-mail: gram@cdsec.com Citadel Data Security Phone: +27(21)23-6065/6/7 Internet/Intranet Network Specialists Mobile: +27(83)-253-9864 Firewalls/Virtual Private Networks Fax: +27(21)24-3656 Data Security Products WWW: http://www.cdsec.com/