[Snort-devel] Re: [Snort-users] depth?

Chris Green cmg at ...81...
Sat Jan 13 11:47:09 EST 2001


Ok, that makes sense.  I hadn't read through mSearchReg and
thought it was taking "first offset, max offset" as parms but I Didn't
catch that it was # of bytes from an index into the buffer already.

Thanks,
Chris

Martin Roesch <roesch at ...48...> writes:

> Actually, I think it needs to look like this:
> 
>  /* we want to match depth bytes anyway */
>  sub_depth = p->dsize - idx->offset; 
> 
>  if((sub_depth > 0) && (sub_depth >= idx->pattern_size))
>  {
> 
> If you ignore the starting offset you can get into trouble checking for
> data beyond the end of the dsize.
> 
>      -Marty
> 
> Chris Green wrote:

-- 
Chris Green <cmg at ...81...>
This is my signature. There are many like it but this one is mine.




More information about the Snort-devel mailing list