[Snort-devel] possible typo fix and questions

Jonathan Chen ccchen at ...2658...
Thu Oct 14 02:00:58 EDT 2004


Dear developer,

	There are two possible typos on the error message in
snort-2.3.0/src/detection-plugins/sp_pattern_match.c:PayloadSearchWithin().
Attached is a quick fix.

	I have a question with range checks in PayloadSearchWithin()
and PayloadSearchDistance(): why are we using idx->offset instad of
idx->within or idx->distance?

    if(idx->offset > 65530)
    {
        FatalError("ERROR %s Line %d => Within greater than max Ipv4 "
                "packet size\n", file_name, file_line);
    }


Also, shouldn't we use 65535 instaead of 65530?

Thanks,


Jonathan
-------------- next part --------------
diff -Naur snort-2.3.0/src/detection-plugins/sp_pattern_match.c snort-2.3.0-typofix/src/detection-plugins/sp_pattern_match.c
--- snort-2.3.0/src/detection-plugins/sp_pattern_match.c        2004-09-23 17:29:42.000000000 +0800
+++ snort-2.3.0-typofix/src/detection-plugins/sp_pattern_match.c        2004-10-14 16:23:55.000000000 +0800
@@ -1101,8 +1101,8 @@
 
     if(idx == NULL)
     {
-        FatalError("Error %s(%d) => Distance without context, please place "
-                "\"content\" keywords before distance modifiers\n", file_name,
+        FatalError("Error %s(%d) => Within without context, please place "
+                "\"content\" keywords before within modifiers\n", file_name,
                 file_line);
     }
 


More information about the Snort-devel mailing list