If ulogd2 receives a signal it will attempt to re-open the pcap output file. If this fails (because the permissions or ownership have changed for example), the FILE pointer will be null and when the next packet comes in, the null pointer will be passed to fwrite and ulogd will crash. The first patch simplifies the logic of the code that opens the output file, and the second avoids closing the existing stream if `fopen` fails. Link: https://bugs.launchpad.net/ubuntu/+source/ulogd2/+bug/1429778 Change since v2 * The first patch is new. * In the second patch, just keep the old stream open, rather than disabling output and trying to reopen at intervals. Change since v1 * Correct subject-prefix. Jeremy Sowden (2): pcap: simplify opening of output file pcap: prevent crashes when output `FILE *` is null output/pcap/ulogd_output_PCAP.c | 50 +++++++++++++-------------------- 1 file changed, 19 insertions(+), 31 deletions(-) -- 2.39.2