Pantek Library
Hosting Provided By
CybrHost
High Speed Hosting
Mailing Lists: snort.org > snort-devel > 03 > 080702.html (Request Expert snort.org Support)

[Snort-devel] 2.0.0-bug: Wrong Parameter to SetEvent

From: Bob Perkins <rperkins(at)tcsg.net>
Date: Fri Aug 01 2003 - 13:09:02 EDT


In the current revision of src/decode.c (1.100) and previous versions, if the header length (hlen) is greater than the packet length (len), the wrong event id is passed to SetEvent. The following patch corrects the problem.


% diff -u src/decode.c.orig src/decode.c --- src/decode.c.orig Fri Jul 25 15:17:28 2003 +++ src/decode.c Fri Aug 1 16:49:04 2003 @@ -2140,7 +2140,7 @@ 
          if((runMode == MODE_IDS) && pv.decoder_flags.decode_alerts)
          {
              SetEvent(&event, GENERATOR_SNORT_DECODE,
-                    DECODE_TCP_INVALID_OFFSET, 1, DECODE_CLASS, 5, 0);
+                    DECODE_TCP_LARGE_OFFSET, 1, DECODE_CLASS, 5, 0);
              CallAlertFuncs(p, DECODE_TCP_LARGE_OFFSET_STR, NULL, &event);
              CallLogFuncs(p, DECODE_TCP_LARGE_OFFSET_STR, NULL, &event);
          }
===============================================

Robert Perkins
TransComp Systems, Inc.
(973) 263-4073
rperkins@tcsg.net


This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01

Snort-devel mailing list
Snort-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-devel Received on Tue Aug 5 18:32:13 2003

This archive was generated by hypermail 2.1.8 : Wed Aug 23 2006 - 14:08:06 EDT

Contact Us  Legal Notices  Order Services Online 
Pantek Home  Privacy Policy  IT news  Site Map  Pantek Library