Project

General

Profile

Actions

Bug #25

closed

Negated Port/Address strings parsed incorrectly

Added by Anoop Saldanha over 14 years ago. Updated about 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

A port or address string which is negated more than once is parsed incorrectly. For example a port string of

80] should be parsed 80. The same applies for addresses too.

The functions DetectPortParseDo() and DetectAddressParse2() while handling negated values, don't take into account the negated(!) count with depth. This can be handled by incrementing and decrementing a count for the ! symbol on parsing the port and address and passing this value recursively to the above function. A mod 2 of this count indicates it's not negated, else it's negated.


Files

Actions

Also available in: Atom PDF