[Snort-devel] [ snort-Bugs-563935 ] spo_database.c sql statements failing

noreply at ...12... noreply at ...12...
Mon Jun 17 20:12:03 EDT 2002


Bugs item #563935, was opened at 2002-06-03 09:11
You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=563935&group_id=3357

Category: None
Group: None
Status: Open
Resolution: None
Priority: 5
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Nobody/Anonymous (nobody)
Summary: spo_database.c sql statements failing

Initial Comment:
After being operational for a while data fail to be entered 
into a mysql database. 

I think what is happening is the snprintf that enters 
sid,cid,data_payload isn't adding a tailing \0 to the string 
so when the strcat appends data is may not be the true 
end of the string and grabage gets used that make the 
payload insert fail.

I would propose appending a \0 to the Values line.

==
Changes chunk of code
==

                snprintf(query->val, MAX_QUERY_LENGTH - 
3, 
                         "INSERT INTO data "
                         "(sid,cid,data_payload) "
                         "VALUES ('%u','%u','%s\0",
                         data->shared->sid, data->shared->cid, 
tmp);
                strcat(query->val, "')");
                free (tmp);
                free (tmp_not_escaped);

===
Original log message
===
database: mysql_error: You have an error in your SQL 
syntax near '')')')')')')')
')' at line 1
SQL=INSERT INTO data (sid,cid,data_payload) 
VALUES ('2','40815','000000040000006
CFFFFFFFF0000133400000064000000720000006F0000
00700000003200000030000000320000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
000000000000000000000000000000000000001DF00000
0000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
0000000000000000000003054C0000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000005700000033000000000000002000000020000000
200000002000000020000000000000001
00000000800000000000000000000000000000000000000
000000000000000000000000550000004
E000000490000005400000031000000000000000000000
0000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000100000001000000
070000000000000001000000010000000
8000000000000000100000001000000CA0000000000000
00100000001000000D2000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
00000*????00+�T?+�W?0000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
000000000000000000000000000000000
00000000000000000000000000000000000000000000000
0000000000000000000000000')')')')
')')')')')

----------------------------------------------------------------------

Comment By: Nobody/Anonymous (nobody)
Date: 2002-06-11 15:52

Message:
Logged In: NO 

Please send this to snort-devel at lists.sourceforge.net 

This bugtracking interface is horrid.  

the embedded \0 is definately the wrong thing to do but
perhaps I can come up with something. 

Do you have the original packet that caused that?

----------------------------------------------------------------------

You can respond by visiting: 
http://sourceforge.net/tracker/?func=detail&atid=103357&aid=563935&group_id=3357




More information about the Snort-devel mailing list