[Snort-devel] Bug in spo_database still remains

Kreimendahl, Chad J Chad.Kreimendahl at ...1167...
Tue Nov 12 10:19:03 EST 2002

Ahh, Finally found the problem:  Apparently oracle doesn't like the
BEGIN statement (without a bunch of other stuff that isn't supported in
the current spo_databse)... Anyway, looking at the code, it appears that
BEGIN is actually unnecessary for Oracle, for what it appears to be
doing here.  So, the fix is to not use BEGIN with Oracle.... Here is the

diff -Nu spo_database.c new_spo_database.c

--- spo_database.c      Tue Nov 12 12:17:05 2002
+++ new_spo_database.c  Tue Nov 12 12:18:19 2002
@@ -1552,7 +1552,10 @@
        Insert("BEGIN TRAN", data);
+       /* No need for begin in Oracle...            */
        Insert("BEGIN", data);
-----Original Message-----
From: Kreimendahl, Chad J 
Sent: Tuesday, November 12, 2002 11:12 AM
To: snort-devel at lists.sourceforge.net
Subject: [Snort-devel] Bug in spo_database still remains

The following happens once every time a new event is inserted into the
database.  We've done traces, and can't seem to locate which statement
is causing the problem.  This problem begins in revision 1.56 of

database: oracle_error: ORA-06550: line 1, column 5:
PLS-00103: Encountered the symbol "end-of-file" when expecting one of
the following:

   begin case declare exit for goto if loop mod null pragma
   raise return select update while with <an identifier>
   <a double-quoted delimited-identifier> <a bind variable> <<
   close current delete fetch lock insert open rollback
   savepoint set sql execute commit forall merge
   <a single-quoted SQL string> pipe

This sf.net email is sponsored by: 
To learn the basics of securing your web site with SSL, 
click here to get a FREE TRIAL of a Thawte Server Certificate: 
Snort-devel mailing list
Snort-devel at lists.sourceforge.net

More information about the Snort-devel mailing list