What steps will reproduce the problem?
1.
Install on Macos (10.9.2) with macports (https://trac.macports.org/ticket/43573
nfex r20)
2.
$ nfex -f attack-trace.pcap -c /opt/local/etc/nfex.conf -v
nfex - realtime network file extraction engine
loading configuration file...
1 exe search code compiled (10000000 byte max)
Abort trap: 6
(pcap from http://honeynet.org/node/504)
What is the expected output? What do you see instead?
extraction of executable file
What version of the product are you using? On what operating system?
Macos 10.9.2
Please provide any additional information below.
A test run in the Makefile would be a nice addition to ensure good execution
gdb doesn't help much sadly
$ ggdb
/Volumes/Data/opt/local/var/macports/build/_Volumes_Data_myports_security_nfex/n
fex/work/trunk/src/nfex
GNU gdb (GDB) 7.6
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-apple-darwin13.0.0".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from
/Volumes/Data/opt/local/var/macports/build/_Volumes_Data_myports_security_nfex/n
fex/work/trunk/src/nfex...done.
(gdb) run -f attack-trace.pcap_ -c /opt/local/etc/nfex.conf -v
Starting program:
/Volumes/Data/opt/local/var/macports/build/_Volumes_Data_myports_security_nfex/n
fex/work/trunk/src/nfex -f attack-trace.pcap_ -c /opt/local/etc/nfex.conf -v
nfex - realtime network file extraction engine
loading configuration file...
1 exe search code compiled (10000000 byte max)
Program received signal SIGABRT, Aborted.
0x00007fff86ec0866 in ?? ()
(gdb) bt
#0 0x00007fff86ec0866 in ?? ()
#1 0x00007fff9363d35c in ?? ()
#2 0x0000000000000000 in ?? ()
better if using gdb-apple
nfex - realtime network file extraction engine
loading configuration file...
1 exe search code compiled (10000000 byte max)
Program received signal SIGABRT, Aborted.
0x00007fff86ec0866 in __pthread_kill ()
(gdb) bt
#0 0x00007fff86ec0866 in __pthread_kill ()
#1 0x00007fff9363d35c in pthread_kill ()
#2 0x00007fff93d0cb1a in abort ()
#3 0x00007fff93d0cc91 in abort_report_np ()
#4 0x00007fff93d30860 in __chk_fail ()
#5 0x00007fff93d30830 in __chk_fail_overflow ()
#6 0x00007fff93d30b6e in __snprintf_chk ()
#7 0x0000000100002b22 in control_context_init (output_dir=<value temporarily
unavailable, due to optimizations>, yyinfname=<value temporarily unavailable,
due to optimizations>, device=<value temporarily unavailable, due to
optimizations>, capfname=<value temporarily unavailable, due to optimizations>,
geoip_data=0x7fff5fbff0e0 "", bpf=0x7fff5fbfefe0 "tcp", flags=1, errbuf=<value
temporarily unavailable, due to optimizations>) at init.c:203
#8 0x00000001000024ba in main (argc=<value temporarily unavailable, due to
optimizations>, argv=0x7fff5fbff2b0) at main.c:104
Original issue reported on code.google.com by
julien....@gmail.comon 5 May 2014 at 6:01