[Snort-devel] Re: [Snort-users] depth?

Chris Green cmg at ...81...
Sat Jan 13 11:47:09 EST 2001

Ok, that makes sense.  I hadn't read through mSearchReg and
thought it was taking "first offset, max offset" as parms but I Didn't
catch that it was # of bytes from an index into the buffer already.


Martin Roesch <roesch at ...48...> writes:

> Actually, I think it needs to look like this:
>  /* we want to match depth bytes anyway */
>  sub_depth = p->dsize - idx->offset; 
>  if((sub_depth > 0) && (sub_depth >= idx->pattern_size))
>  {
> If you ignore the starting offset you can get into trouble checking for
> data beyond the end of the dsize.
>      -Marty
> Chris Green wrote:

Chris Green <cmg at ...81...>
This is my signature. There are many like it but this one is mine.

More information about the Snort-devel mailing list