Ethereal-users: Re: [Ethereal-users] bus errone (core dumped)

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 30 Apr 2001 11:12:06 -0700 (PDT)
> I have installed ethereal0.8.12 whith  glib1.2.8 , gtk+ 1.2.8,
>       libpcap0.6.1 and  ucd-snmp4.2.1 ===> no problem during the install

Note that 0.8.12 is an old version of Ethereal.

> error message when I launch ethereal ===> bus errone (core dumped)
> 
> Here is this core file ===> (See attached file: core)

Given that the core dump came from a SPARC machine, the most likely
reason for a bus error is that some piece of code in Ethereal tried to
dereference a misaligned pointer, which would probably be the result of
some dissector (probably developed by somebody on a PC, where misaligned
pointer dereferences are unlikely to cause a problem, as few if any OSes
for PC's with 486-or-later processors disable unaligned accesses in the
processor) naively thinking it can take a pointer to some 2-byte or
4-byte integer (or to a floating-point number) in a packet and just use
it.

As such, I would suggest getting a later version of Ethereal; if this
was on Solaris rather than, say, Linux/SPARC, this may require you to
download the source and build it yourself.

(The core dump would be useful only to somebody with the same version of
the same OS that you're running, with the same binary versions of
third-party libraries installed, and the same binary version of Ethereal
installed; far more useful would be a stack trace - if you have gdb
installed, do

	gdb ethereal core

and then use the "bt" command to get a stack trace; if it's a Solaris
machine and you hae DBX installed, do

	dbx ethereal core

and use the "where" commadn to get a stack trace.

Note, however, that all the stack trace may tell us is that this is a
bug in 0.8.12 and you need to get a newer version of Ethereal.)