Project

General

Profile

Actions
Copy link

Bug #1110

closed

Can have the same Pattern ID (pid) for the same pattern but different case flags

Added by Ken Steele almost 11 years ago. Updated over 10 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Ken Steele
Target version:
2.0rc2
Affected Versions:
Effort:
Difficulty:
Label:

Description

The code that assigns pattern IDs (pids) doesn't check the NO_CASE flag when comparing patterns to find duplicates. The means that "foo":NO_CASE and "foo":CASE would get the same pid, when they should get different PIDs.

Actions
Copy link
 #1

Updated by Ken Steele almost 11 years ago

  • % Done changed from 0 to 90

Fixed by; https://github.com/inliniac/suricata/pull/842

When assigning pids, duplicates now must have the same NO_CASE flag. Also, for NO_CASE patterns, use NO_CASE matching to compare patterns.

Actions
Copy link
 #2

Updated by Victor Julien over 10 years ago

  • Status changed from New to Assigned
  • Target version set to 2.0rc2
Actions
Copy link
 #3

Updated by Victor Julien over 10 years ago

  • Status changed from Assigned to Closed
  • % Done changed from 90 to 100
Actions
Copy link

Also available in: Atom PDF