Runtime error: slice bounds out of range

Elastic Stack Beats
1

Hello, everyone, I run packetbeat-1.2.3 find a runtime error log. Real time network traffic is about 10MB/S, please help me,thanks very much!

operating system:centos 7
The specific error log is as follows：

2016-05-26T23:35:34+08:00 ERR ParseHttp exception. Recovering, but please report this: runtime error: slice bounds out of range.
2016-05-26T23:35:34+08:00 ERR Stacktrace: /go/src/github.com/elastic/beats/libbeat/logp/log.go:114 (0x4c5a96)
/usr/local/go/src/runtime/asm_amd64.s:437 (0x47c88e)
/usr/local/go/src/runtime/panic.go:423 (0x44b119)
/usr/local/go/src/runtime/panic.go:18 (0x449659)
/go/src/github.com/elastic/beats/packetbeat/protos/http/http_parser.go:143 (0x4e5ccb)
/go/src/github.com/elastic/beats/packetbeat/protos/http/http_parser.go:96 (0x4e4d97)
/go/src/github.com/elastic/beats/packetbeat/protos/http/http.go:296 (0x4df8d2)
/go/src/github.com/elastic/beats/packetbeat/protos/http/http.go:229 (0x4df326)
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:101 (0x52ca31)
/go/src/github.com/elastic/beats/packetbeat/protos/tcp/tcp.go:164 (0x52d573)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:183 (0x7137b7)
/go/src/github.com/elastic/beats/packetbeat/decoder/decoder.go:101 (0x712cf1)
/go/src/github.com/elastic/beats/packetbeat/sniffer/sniffer.go:356 (0x5417f9)
/go/src/github.com/elastic/beats/packetbeat/beat/packetbeat.go:232 (0x481d4b)
/usr/local/go/src/runtime/asm_amd64.s:1696 (0x47ebd1)

2

This looks like a bug. Could you share your config files and more details on the traffic causing this? To fix this, the easiest would be if you could provide a pcap file that causes this issue so we can reproduce it.

3

Can you please try with packetbeat 5.0-alpha2 (or 3 when out)?

Normally these errors occur when parser is not fully in sync to TCP stream (needs to sync first). After having some packet-loss, this error might occur due to parser out of sync thanks to the packet loss. It's not critical, as parser (not being in sync yet) will drop it's current state and retry to syncing the stream.

Some protocol parsers have been hardened a little, but not sure about HTTP.