[Snort-devel] possible typo fix and questions

Daniel Roelker droelker at ...402...
Fri Oct 15 22:55:03 EDT 2004


Thanks for the report Johnathon.  We actually just checked these changes
into CVS yesterday, and they will be in the 2.3 release.

Dan

On Mon, 2004-10-11 at 17:56, Jonathan Chen wrote:
> Dear developer,
> 
> 	There are two possible typos on the error message in
> snort-2.3.0/src/detection-plugins/sp_pattern_match.c:PayloadSearchWithin().
> Attached is a quick fix.
> 
> 	I have a question with range checks in PayloadSearchWithin()
> and PayloadSearchDistance(): why are we using idx->offset instad of
> idx->within or idx->distance?
> 
>     if(idx->offset > 65530)
>     {
>         FatalError("ERROR %s Line %d => Within greater than max Ipv4 "
>                 "packet size\n", file_name, file_line);
>     }
> 
> 
> Also, shouldn't we use 65535 instaead of 65530?
> 
> Thanks,
> 
> 
> Jonathan
> ----
> 

> diff -Naur snort-2.3.0/src/detection-plugins/sp_pattern_match.c snort-2.3.0-typofix/src/detection-plugins/sp_pattern_match.c
> --- snort-2.3.0/src/detection-plugins/sp_pattern_match.c        2004-09-23 17:29:42.000000000 +0800
> +++ snort-2.3.0-typofix/src/detection-plugins/sp_pattern_match.c        2004-10-14 16:23:55.000000000 +0800
> @@ -1101,8 +1101,8 @@
>  
>      if(idx == NULL)
>      {
> -        FatalError("Error %s(%d) => Distance without context, please place "
> -                "\"content\" keywords before distance modifiers\n", file_name,
> +        FatalError("Error %s(%d) => Within without context, please place "
> +                "\"content\" keywords before within modifiers\n", file_name,
>                  file_line);
>      }
>  
-- 
Daniel Roelker
Lead Snort Developer
Sourcefire, Inc.





More information about the Snort-devel mailing list