[Snort-users] Bug in mSearchREG() that can make Snort go into an infinite loop.

Martin Roesch roesch at ...1935...
Sun Feb 24 18:59:04 EST 2002


It should probably be noted that the regex code is still non-functional
(i.e. It doesn't work right) which is why it's not discussed in the
docs/polite company.  The fact that it could hang was nasty, but it's not
even supposed to work yet, so I wouldn't put a whole lot of faith in it
working even if it doesn't spin the computer off into navel-staring mode.

     -Marty

On 2/24/02 12:08 PM, "Chris Green" <cmg at ...671...> wrote:

> Andreas Östling <andreaso at ...236...> writes:
> 
>> Hello,
>> 
>> As described by a few others (for example
>> http://sourceforge.net/tracker/index.php?func=detail&aid=494612&group_id=3357
>> &atid=103357)
>> my Snort sometimes also stopped logging, and went up to near 100% CPU
>> usage.
> 
> Ahh Thanks for the patch.  Applying it now..  Regex rules are still
> not something to write home about but this is a critical bug.

-- 
Martin Roesch - Founder/CEO Sourcefire Inc. - (410) 552-6999
Sourcefire: Professional Snort Sensor and Management Console appliances
roesch at ...1935... - http://www.sourcefire.com
Snort: Open Source Network IDS - http://www.snort.org





More information about the Snort-users mailing list