[Pierre JUHEN <pierre.juhen@xxxxxxxxxx>]

Hello,

I did recompile, and tried to locate the problem using gdb.

It occurs in do_capture :

/* 
------------------------------------------------------------------------------------------------------------------------------*/
gboolean
do_capture(capture_options *capture_opts)
{
 gboolean is_tempfile;
 gboolean ret;


 /* open the new output file (temporary/specified name/ringbuffer) */
 if(!capture_open_output(capture_opts, &is_tempfile)) {
   return FALSE;
 }

 /* close the currently loaded capture file */
 cf_close(capture_opts->cf);

 /* We could simply use TRUE for this expression now, this will work 
for all
  * captures except for some of the multiple files options, as these 
capture
  * options currently cannot be passed through the command line to the
  * capture child.
  *
  * If this is fixed, we could always use the sync mode, throwing away the
  * normal mode completely and doing some more cleanup. */
/*  if (TRUE) {*/
 if (capture_opts->sync_mode) {
   /* sync mode: do the capture in a child process */
   ret = sync_pipe_do_capture(capture_opts, is_tempfile);

/* 
------------------------------------------------------------------------------------------------------------------------------*/

whe I put a break point at the beginning and step one instruction I have :

(gdb) print capture_opts
$11 = (capture_options *) 0x60b2e0

and

(gdb) print *capture_opts
$12 = {cf = 0x5fb100, cfilter = 0xa8f810 "", iface = 0xca57c0 "eth0", 
has_snaplen = 0, snaplen = 68, promisc_mode = 1, linktype = -1, 
capture_child = 0,
 save_file = 0x0, save_file_fd = -1, sync_mode = 1, show_info = 0, 
quit_after_cap = 0, multi_files_on = 0, has_file_duration = 0, 
file_duration = 60,
 has_ring_num_files = 1, ring_num_files = 2, has_autostop_files = 0, 
autostop_files = 1, has_autostop_packets = 0, autostop_packets = 0,
 has_autostop_filesize = 0, autostop_filesize = 1048576, 
has_autostop_duration = 0, autostop_duration = 60, fork_child = -1}

which is correct

Then I put a second breakpoint  before 
"sync_pipe_do_capture(capture_opts, is_tempfile)"

I get

(gdb) print capture_opts
$13 = (capture_options *) 0x7fbfffdeac
(gdb) print *capture_opts
$14 = {cf = 0xc586f000000001, cfilter = 0x6496d000000000 <Address 
0x6496d000000000 out of bounds>,
 iface = 0x706d742f00000000 <Address 0x706d742f00000000 out of bounds>, 
has_snaplen = 1752458543, snaplen = 1482191461, promisc_mode = 1448237144,
 linktype = 845242968, capture_child = 0, save_file = 0x6407e000000033 
<Address 0x6407e000000033 out of bounds>, save_file_fd = 0, sync_mode = 
6592208,
 show_info = 0, quit_after_cap = 6555616, multi_files_on = 0, 
has_file_duration = 2108856777, file_duration = 51, has_ring_num_files = 
6553696,
 ring_num_files = 0, has_autostop_files = 12945136, autostop_files = 0, 
has_autostop_packets = 10616512, autostop_packets = 0,
 has_autostop_filesize = 4523330, autostop_filesize = 0, 
has_autostop_duration = 1, autostop_duration = 0, fork_child = 13043216}


Obvisously, the stack has been corrupted in between.

Going further, before calling cf_close, the stack is still OK.

Therefore, cf_close corrupts the stack....

Thank you for your help....

Pierre JUHEN