[Snort-users] ACID: Bug in decoding of ICMP packets payload?

Jesus Couto jesus.couto at ...3830...
Thu Jan 10 10:24:06 EST 2002


Thanks for the quick fix; I checked out the CVS source and saw the 
patch. Didnt new about the padding...

Reading the patch I got to:


              /* Will be incorrect if there are IP options */
              $icmp_src_port = 
hexdec($work[44+$offset].$work[45+$offset].$work[46+$offset].$work[47+$offset]);
              $icmp_dst_port = 
hexdec($work[48+$offset].$work[49+$offset].$work[50+$offset].$work[51+$offset]);

I think that could easily be fixed with, say:

            $header=$work[$offset+1]*8+$offset;
            $icmp_src_port = 
hexdec($work[$header].$work[$header+1].$work[$header+2].$work[$header+3]);
            $icmp_dst_port = 
hexdec($work[$header+4].$work[$header+5].$work[$header+6].$work[$header+7]);

Right?

Thanks again and good luck,

Jesús Couto F.





More information about the Snort-users mailing list