[Snort-devel] Snort 1.7 SegFaults Reading a Bad Rule File

Martin Roesch roesch at ...48...
Wed Feb 7 02:57:41 EST 2001


See my other message.  Lets not rush into this, we need to approach
changing the entire rules language very carefully...

   -Marty

Fyodor wrote:
> 
> On Sun, Jan 28, 2001 at 01:33:31PM -0500, Todd Lewis wrote:
> > On Sat, 27 Jan 2001, Crist J. Clark wrote:
> >
> > > I guess you can say that whitespace is not allowed there, but Snort
> > > should flag the error and not core dump. It took me a long time to
> > > figure out what the problem in my rules file was when I found this
> > > bug.
> > >
> > > Personally, I like allowing the extra whitespace. But the easiest fix
> > > is probably to flag it as an error. I nosed around ParseIP() and
> > > mSplit(), but I could not decide on the most correct way to fix this
> > > behavior.
> >
> > <your eyes open to a perfectly blue sky>
> > <you hear birds chirping>
> > <you hear surf in the distance crashing over rocks>
> > <a voice starts speaking; you do not perceive the source, but you're groggy>
> >
> > xml never segfaults...
> >
> 
> After thinking for a while.. :) shall we maybe stick with xml as well in snort 2.x implementation? (and
> just code up snort1x->snort2x rules converter). I was playing with some applications the other day,
> which deploy xml heavily in its configuration files and frankly speaking I quite liked it. Plus XML should give
> us enough flexebility to extend our grammar as much as we need that (and it's easy to parse too :-))
> 
> _______________________________________________
> Snort-devel mailing list
> Snort-devel at lists.sourceforge.net
> http://lists.sourceforge.net/lists/listinfo/snort-devel

--
Martin Roesch
roesch at ...48...
http://www.snort.org




More information about the Snort-devel mailing list