Segfault in shared library. How to debug?

Question

I use a library (libnids) in my program. I call the function nids_run from the library which continues running until I explicitly call nids_exit. My program handles SIGINT and calls nids_exit. The interrupt handler returns normally, but sometimes before the library returns the control to my program, I receive a segfault. This is the backtrace GDB gives me: ``` #0 0x00007ffff6498b2a in ?? () from /usr/lib/libpcap.so.1 #1 0x00007ffff649bee1 in pcap_loop () from /usr/lib/libpcap.so.1 #2 0x00007ffff77bae66 in nids_run () from /usr/lib/libnids.so.1.24 #3 0x0000000000401e92 in main (argc=3, argv=0x7fffffffebf8) at eve.c:139 ``` What is the best strategy to find the problem? Should I somehow debug libpcap? UPDATE: As suggetsed by ArjunShankar, I ran my program under Valgrind. This is part of the output: ``` ==7504== Invalid read of size 4 ==7504== at 0x654EDC1: ??? (in /usr/lib/libpcap.so.1.2.1) ==7504== by 0x6551EE0: pcap_loop (in /usr/lib/libpcap.so.1.2.1) ==7504== by 0x5250E65: nids_run (…

Accepted Answer

The Valgrind output shows that `libpcap` (from inside `nids_run`) tries to read memory locations after `nids_exit` `free`s them:

e.g.:

```
==7504== Invalid read of size 4
==7504==    at 0x654EDC1: ??? (in /usr/lib/libpcap.so.1.2.1)
==7504==    by 0x6551EE0: pcap_loop (in /usr/lib/libpcap.so.1.2.1)
==7504==    by 0x5250E65: nids_run (in /usr/lib/libnids.so.1.24)

Address 0x70eece8 is 40 bytes inside a block of size 768 free'd
==7504==    at 0x4C29A9E: free
==7504==    by 0x5250DEB: nids_exit (in /usr/lib/libnids.so.1.24)
```

So that is a 768 sized block, that is `free`d in `nids_exit`, and subsequently read inside `nids_run` (which apparently has not stopped yet).

All other errors are similar (`nids_exit` `free`s a block, and `nids_run` continues to try to use it.

What this means is: You're either not using libnids (`nids_run`/`nids_exit`) correctly, or there is a bug in `libnids`.

Segfault in shared library. How to debug?

Solution

Problem