klogg
klogg copied to clipboard
Hyperscan search crashes on 32-bit windows builds
Crashed Thread: 15840
Application Specific Information:
Fatal Error: EXCEPTION_ACCESS_VIOLATION_READ
Thread 15840 Crashed:
0 klogg.exe 0x917c03 [inlined] load_m128_from_u64a (simd_utils.h:186)
1 klogg.exe 0x917c03 [inlined] nfaExecLimEx64_Stream (limex_runtime_impl.h:253)
2 klogg.exe 0x917c03 nfaExecLimEx64_Stream_Silent (limex_runtime_impl.h:570)
3 klogg.exe 0x91198f nfaExecLimEx64_QR (limex_runtime_impl.h:890)
4 klogg.exe 0x9a50dc roseRunProgram (program_runtime.c:2486)
5 klogg.exe 0x758a51 [inlined] roseProcessMatchInline (match.c:244)
6 klogg.exe 0x758a51 [inlined] roseCallback_i (match.c:512)
7 klogg.exe 0x758a51 roseFloatingCallback (match.c:533)
8 klogg.exe 0xaf11b5 [inlined] confWithBit (fdr_confirm_runtime.h:96)
9 klogg.exe 0xaf11b5 [inlined] do_confWithBit_teddy (teddy_runtime_common.h:438)
10 klogg.exe 0xaf11b5 fdr_exec_teddy_msks3 (teddy.c:1095)
11 klogg.exe 0x8c8811 fdrExec (fdr.c:849)
12 klogg.exe 0x714baa hwlmExec (hwlm.c:198)
13 klogg.exe 0x735182 [inlined] roseBlockFloating (block.c:259)
14 klogg.exe 0x735182 roseBlockExec (block.c:398)
15 klogg.exe 0x6f2ea1 [inlined] rawBlockExec (runtime.c:188)
16 klogg.exe 0x6f2ea1 hs_scan (runtime.c:419)
17 klogg.exe 0x61521b HsMatcher::hasMatch (hsregularexpression.cpp:67)
There is an active issue about something similar: intel/hyperscan#249
Data from github downloads suggests that x86 version of klogg is not very popular:
klogg-20.12.0.813-x86-portable.zip (10,80 MiB) — Downloaded 255 times
klogg-20.12.0.813-x86-setup.exe (8,39 MiB) — Downloaded 197 times
klogg-20.12.0.813-x64-portable.zip (12,55 MiB) — Downloaded 1 007 times
klogg-20.12.0.813-x64-setup.exe (9,68 MiB) — Downloaded 1 701 times
Unfortunately, hyperscan has to be disabled in x86 builds until upstream issue is resolved.
Leaving this open to periodically track status of upstream bug.
Consider switching to vectorscan
Vectorscan builds are now possible by changing config in cmake. Can be used in 32-bit builds but need more testing.