Renaming Fields Causes Segfault


I'm trying to rename the conn id fields using the following:

redef Log::default_field_name_map = {
["id.orig_h"] = "src_ip",
["id.orig_p"] = "src_port",
["id.resp_h"] = "dst_ip",
["id.resp_p"] = "dst_port"

Bro produces the logs I would expect with the new field names, but segfaults before exiting when testing on a number of pcaps. Here is one example of a public pcap that causes this problem:

I ran the pcap using only the above script: bro -C -r auth_change_session_keys.pcap rename.bro

This is the gdb backtrace:
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-110.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
Reading symbols from /usr/local/bro/bin/bro...done.
[New LWP 3760]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/".
Core was generated by `bro -C -r auth_change_session_keys.pcap rename.bro'.
Program terminated with signal 11, Segmentation fault.
#0 malloc_consolidate (av=av@entry=0x7fcc30f41760 <main_arena>) at malloc.c:4160
4160 nextsize = chunksize(nextchunk);
(gdb) bt
#0 malloc_consolidate (av=av@entry=0x7fcc30f41760 <main_arena>) at malloc.c:4160
#1 0x00007fcc30bfc37e in _int_free (av=0x7fcc30f41760 <main_arena>, p=0x5a50b80, have_lock=0) at malloc.c:4066
#2 0x000000000085e1f1 in DFA_State::~DFA_State (this=0x5a44a80, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#3 0x000000000085e288 in DFA_State::~DFA_State (this=0x5a44a80, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#4 0x00000000008165e1 in Unref (o=0x5a44a80) at /var/opt/test/bro-2.5.5/src/Obj.h:222
#5 0x000000000085ef34 in DFA_State_Cache::~DFA_State_Cache (this=0x598c4c0, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#6 0x000000000085f55f in DFA_Machine::~DFA_Machine (this=0x59847f0, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#7 0x000000000085f5b8 in DFA_Machine::~DFA_Machine (this=0x59847f0, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#8 0x00000000008165e1 in Unref (o=0x59847f0) at /var/opt/test/bro-2.5.5/src/Obj.h:222
#9 0x00000000008fbb2d in Specific_RE_Matcher::~Specific_RE_Matcher (this=0x5921710, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#10 0x000000000091190a in RuleHdrTest::~RuleHdrTest (this=0x546eef0, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#11 0x00000000009121ec in RuleMatcher:elete (this=0x53e8490, node=0x546eef0) at /var/opt/test/bro-2.5.5/src/
#12 0x00000000009121cc in RuleMatcher:elete (this=0x53e8490, node=0x53e8640) at /var/opt/test/bro-2.5.5/src/
#13 0x000000000091210c in RuleMatcher::~RuleMatcher (this=0x53e8490, __in_chrg=<optimized out>) at /var/opt/test/bro-2.5.5/src/
#14 0x0000000000832445 in main (argc=5, argv=0x7fff8a7ddfb8) at /var/opt/test/bro-2.5.5/src/

Please let me know if I can provide any additional information.




Seth Hall
September 11, 2018, 3:35 AM

I can confirm that there is some issue here. The stack trace that I got was different and points more toward the expected issue...

Jon Siwek
September 11, 2018, 10:09 AM




Mike M



External issue ID



Fix versions

Affects versions