[Snort-devel] Snort 1.7 SegFaults Reading a Bad Rule File

Todd Lewis tlewis at ...120...
Sun Jan 28 13:33:31 EST 2001


On Sat, 27 Jan 2001, Crist J. Clark wrote:

> I guess you can say that whitespace is not allowed there, but Snort
> should flag the error and not core dump. It took me a long time to
> figure out what the problem in my rules file was when I found this
> bug. 
> 
> Personally, I like allowing the extra whitespace. But the easiest fix
> is probably to flag it as an error. I nosed around ParseIP() and
> mSplit(), but I could not decide on the most correct way to fix this
> behavior.

<your eyes open to a perfectly blue sky>
<you hear birds chirping>
<you hear surf in the distance crashing over rocks>
<a voice starts speaking; you do not perceive the source, but you're groggy>

xml never segfaults...

<pause>

xml requires less code...

<pause>

it'd be easy to translate from the existing format to xml...

<then you wake up>

--
Todd Lewis                                       tlewis at ...120...

  God grant me the courage not to give up what I think is right, even
  though I think it is hopeless.          - Admiral Chester W. Nimitz





More information about the Snort-devel mailing list