[Snort-devel] Re: [Snort-users] depth?
cmg at ...81...
Sat Jan 13 11:47:09 EST 2001
Ok, that makes sense. I hadn't read through mSearchReg and
thought it was taking "first offset, max offset" as parms but I Didn't
catch that it was # of bytes from an index into the buffer already.
Martin Roesch <roesch at ...48...> writes:
> Actually, I think it needs to look like this:
> /* we want to match depth bytes anyway */
> sub_depth = p->dsize - idx->offset;
> if((sub_depth > 0) && (sub_depth >= idx->pattern_size))
> If you ignore the starting offset you can get into trouble checking for
> data beyond the end of the dsize.
> Chris Green wrote:
Chris Green <cmg at ...81...>
This is my signature. There are many like it but this one is mine.
More information about the Snort-devel