[Snort-devel] RE: regarding recent strcasecmp patch

Michael.Slifcak at ...1192... Michael.Slifcak at ...1192...
Fri Mar 29 14:36:05 EST 2002


Chris,
As you've requested, I'm including modified strcasecmp patches to be applied
against the 1.9 branch.

This has given me an opportunity to review the initial patch attempt, and
I've found some
improvements that are now incorporated.

I'll let you know that I'm a little uncomfortable with checking this in.

The changes are compile OK, but have not seen actual use.

I note that preceding some of the uses of strncasecmp,
there are "strtok" calls and "strstr" calls to parse up to commas and other
punctuation .
This leads me to believe that there may be trailing whitespace in the token
being
compared.

I intend to try them out further, but they really should get more scrutiny
from the developers who are familiar with the parsing activity.

I hope this doesn't amount to busy work for the community.

I just want folks to know that I have about 80 percent confidence that these
changes are good,
and that all are welcomed to try as an experiment.  But I would not
recommend that you
go to production machines with this just yet.

Best Regards,
-Mike Slifcak

-------------- next part --------------
A non-text attachment was scrubbed...
Name: current.strcasecmp.patch
Type: application/octet-stream
Size: 52493 bytes
Desc: not available
URL: <https://lists.snort.org/pipermail/snort-devel/attachments/20020329/707ed002/attachment.obj>


More information about the Snort-devel mailing list