Re: Problem passing a string to a function

On Dec 26, 4:58 pm, Shashank <shashank.shanb...@xxxxxxxxx> wrote:
Hi,
I am passing a tcpdump filter to a function which compiles the filter
using pcap_compile and then sets it.
Here is the filter,

ip[12:4]>=0x0000 and ip[12:4] <=0xd9295a3 and ip[16:4] >=0x0000 and
ip[16:4] <=0x3ca9b416 and tcp[0:2]>=0 and tcp[0:2]<=23923 and
tcp[2:2]>=0 and tcp[2:2]<=64582 and tcp[2:2]<=655355

I have many threads passing  different filters of a similar form to
the same function.

The problem is, 8 out of 10 times, the string gets passed successfully
and compiled without any problem, but the 2 times, the string gets
manipulated in a random manner.

For example, in this case, the filter was passed as

ip[12:4]>=0x0000 and ip[12:4] <=0xd9295a3 and ip[16:4] >=0x0000 and
ip[16:4] <=0x3ca9b416 and tcp[0:2]>=0 and tcp[0:2]<=23923 and
tcp[2:2]>=0 and tcp[2:2]<=64582 tcp[2:2]<=655355

which of course resulted in pcap_compile raising a syntax error.

Here is a part of the output for 10 threads:

ip[12:4]>=0x0000 and ip[12:4] <=0x4e82b543 and ip[16:4] >=0x0000 and
ip[16:4] <=0x6f835b87 and tcp[0:2]>=0 and tcp[0:2]<=13052 and
tcp[2:2]>=0 and tcp[2:2]<=14069n
Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x4e82b543 and
ip[16:4] >=0x0000 and ip[16:4] <=0x6f835b87 and tcp[0:2]>=0 and
tcp[0:2]<=13052 and tcp[2:2]>=0 and tcp[2:2]<=14069n: syntax error
******************
PASSED WITHOUT ERROR
ip[12:4]>=0x4e82b544 and ip[12:4] <=0xffffffff and ip[16:4]>=0x6f835b88 and ip[16:4] <=0xffffffff and tcp[0:2]>=13053 and

tcp[0:2]<=65535 and tcp[2:2]>=14070 and tcp[2:2]<=65535
******************
ip[12:4]>=0x0000 and ip[12:4] <=0xa7997e38 and ip[16:4] >=0x0000 and
ip[16:4] <=0x7b404ab4 and udp[0:2]>=0 and udp[0:2]<=31630 and
udp[2:2]>=0 and udp[2:2]<=27845 tcp[2:2]<=65535
Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0xa7997e38 and
ip[16:4] >=0x0000 and ip[16:4] <=0x7b404ab4 and udp[0:2]>=0 and
udp[0:2]<=31630 and udp[2:2]>=0 and udp[2:2]<=27845 tcp[2:2]<=65535:
syntax error
******************
PASSED WITHOUT ERROR
ip[12:4]>=0xa7997e39 and ip[12:4] <=0xffffffff and ip[16:4]>=0x7b404ab5 and ip[16:4] <=0xffffffff and udp[0:2]>=31631 and

udp[0:2]<=65535 and udp[2:2]>=27846 and udp[2:2]<=65535
******************
ip[12:4]>=0x0000 and ip[12:4] <=0x48fee779 and ip[16:4] >=0x0000 and
ip[16:4] <=0xcbdf7c5 and tcp[0:2]>=0 and tcp[0:2]<=24066 and
tcp[2:2]>=0 and tcp[2:2]<=56142d udp[2:2]<=65535
Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x48fee779 and
ip[16:4] >=0x0000 and ip[16:4] <=0xcbdf7c5 and tcp[0:2]>=0 and
tcp[0:2]<=24066 and tcp[2:2]>=0 and tcp[2:2]<=56142d udp[2:2]<=65535:
syntax error
******************
PASSED WITHOUT ERROR
ip[12:4]>=0x48fee77a and ip[12:4] <=0xffffffff and ip[16:4]>=0xcbdf7c6 and ip[16:4] <=0xffffffff and tcp[0:2]>=24067 and

tcp[0:2]<=65535 and tcp[2:2]>=56143 and tcp[2:2]<=655355
******************
ip[12:4]>=0x0000 and ip[12:4] <=0x1e9e35b and ip[16:4] >=0x0000 and
ip[16:4] <=0x675231ed and tcp[0:2]>=0 and tcp[0:2]<=28481 and
tcp[2:2]>=0 and tcp[2:2]<=50549 tcp[2:2]<=655355
Couldn't parse filter ip[12:4]>=0x0000 and ip[12:4] <=0x1e9e35b and
ip[16:4] >=0x0000 and ip[16:4] <=0x675231ed and tcp[0:2]>=0 and
tcp[0:2]<=28481 and tcp[2:2]>=0 and tcp[2:2]<=50549 tcp[2:2]<=655355:
syntax error
******************

As is evident, the error is pretty random, and mostly toward the end
of the filter with the occasional "and"s missing..

Can anyone please confirm that this is indeed a problem with gcc...?
or are there any particular measures I need to take when passing a
long string?

The problem is not with GCC. It is a problem in your code. I use GCC
all the time for multithreading work without incident.
There are tutorials for libpcap, but I guess you really want
news:comp.programming.threads. But do be a peach and read their FAQ
first:
http://www.lambdacs.com/cpt/FAQ.html
.

Relevant Pages

  • Re: Getting the output of compiler and filtering it
    ... into a new splitted buffer and filter the results a little. ... 2.for: Error: Syntax error, found ',' when expecting one ...
    (comp.editors)
  • Re: Searching (i.e., 3,000,000) in a number field using Filter-By-Form
    ... > enter 3,000,000 I get a syntax error. ... > consistently correctly enter data without the help of commas. ... I'm not surprised you're getting the error with Filter By Form, ... format to one of those text boxes, the value of the text box will be the ...
    (microsoft.public.access.forms)
  • Problem passing a string to a function
    ... I am passing a tcpdump filter to a function which compiles the filter ... which of course resulted in pcap_compile raising a syntax error. ...
    (comp.lang.c)
  • pop-up form to filter report
    ... Hi - Have downloaded the sample database "RptSmp97.mdb". ... Syntax error in query ... I'm now getting the same message no matter which filter ... vendor name combobox shows my alpha vendor ID, ...
    (microsoft.public.access.reports)
  • Re: Source Code to Filter out WindowsMessenger POP-UPS
    ... rejecting all traffic on those same ports from any other IP. ... I just want to filter out ... >>sample code that compiles on Linux, ... >>apply pass/fail rules to - provided the router isn't one ...
    (microsoft.public.inetserver.iis.security)