variar / klogg

Really fast log explorer based on glogg project
https://klogg.filimonov.dev
GNU General Public License v3.0
2.28k stars 197 forks source link

Hyperscan search crashes on 32-bit windows builds #296

Open variar opened 3 years ago

variar commented 3 years ago
Crashed Thread: 15840

Application Specific Information:
Fatal Error: EXCEPTION_ACCESS_VIOLATION_READ

Thread 15840 Crashed:
0   klogg.exe                       0x917c03            [inlined] load_m128_from_u64a (simd_utils.h:186)
1   klogg.exe                       0x917c03            [inlined] nfaExecLimEx64_Stream (limex_runtime_impl.h:253)
2   klogg.exe                       0x917c03            nfaExecLimEx64_Stream_Silent (limex_runtime_impl.h:570)
3   klogg.exe                       0x91198f            nfaExecLimEx64_QR (limex_runtime_impl.h:890)
4   klogg.exe                       0x9a50dc            roseRunProgram (program_runtime.c:2486)
5   klogg.exe                       0x758a51            [inlined] roseProcessMatchInline (match.c:244)
6   klogg.exe                       0x758a51            [inlined] roseCallback_i (match.c:512)
7   klogg.exe                       0x758a51            roseFloatingCallback (match.c:533)
8   klogg.exe                       0xaf11b5            [inlined] confWithBit (fdr_confirm_runtime.h:96)
9   klogg.exe                       0xaf11b5            [inlined] do_confWithBit_teddy (teddy_runtime_common.h:438)
10  klogg.exe                       0xaf11b5            fdr_exec_teddy_msks3 (teddy.c:1095)
11  klogg.exe                       0x8c8811            fdrExec (fdr.c:849)
12  klogg.exe                       0x714baa            hwlmExec (hwlm.c:198)
13  klogg.exe                       0x735182            [inlined] roseBlockFloating (block.c:259)
14  klogg.exe                       0x735182            roseBlockExec (block.c:398)
15  klogg.exe                       0x6f2ea1            [inlined] rawBlockExec (runtime.c:188)
16  klogg.exe                       0x6f2ea1            hs_scan (runtime.c:419)
17  klogg.exe                       0x61521b            HsMatcher::hasMatch (hsregularexpression.cpp:67)

There is an active issue about something similar: intel/hyperscan#249

variar commented 3 years ago

Data from github downloads suggests that x86 version of klogg is not very popular:

klogg-20.12.0.813-x86-portable.zip (10,80 MiB) — Downloaded 255 times
klogg-20.12.0.813-x86-setup.exe (8,39 MiB) — Downloaded 197 times

klogg-20.12.0.813-x64-portable.zip (12,55 MiB) — Downloaded 1 007 times
klogg-20.12.0.813-x64-setup.exe (9,68 MiB) — Downloaded 1 701 times

Unfortunately, hyperscan has to be disabled in x86 builds until upstream issue is resolved.

variar commented 3 years ago

Leaving this open to periodically track status of upstream bug.

variar commented 3 years ago

Consider switching to vectorscan

variar commented 1 year ago

Vectorscan builds are now possible by changing config in cmake. Can be used in 32-bit builds but need more testing.