Re: [Snort-sigs] Announcing sp_perl

Jeff Nathan <jeff@snort.org> writes:

> As described in our CanSecWest/core03 presentation, Advanced IDS, Brian

Religious issues aside,

1. otn->ds_list[PLUGIN_PERL] = (PerlData *)calloc(sizeof(PerlData), sizeof(u_int8_t));

    should be checked

2)
+ /* room for a full-sized IP packet + null terminator */ + memset(tmp_payload, 0, 65537);

  That could be switched to dsize and usually average a 500 byte memset.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related snort.org Links snort-announce snort-cvsinfo snort-devel snort-sigs snort-users Request more information about Pantek

3) tmp_payload[p->dsize - 1] ='\0';

   that ends up being tmp_payload[0xFFFFFFFF] = '\0' on 0 byte packets.

4) dinky optimization
0

        snprintf(srcport, 6, "%hu", 0);
        snprintf(dstport, 6, "%hu", 0);

    can be just
        srcport = "0";
        dstport = "0";

I don't have enough time to look understand the rest.

-- 
Chris Green 
Fame may be fleeting but obscurity is forever.

------------------------------------------------------- Enterprise Linux Forum Conference & Expo, June 4-6, 2003, Santa Clara The only event dedicated to issues related to Linux enterprise solutions www.enterpriselinuxforum.com _______________________________________________ Snort-sigs mailing list Snort-sigs@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/snort-sigs