Bug #445

Byte extract/jump/test doesn't handle negative offsets

Added by Anoop Saldanha about 2 years ago. Updated about 2 years ago.

Status:ClosedStart date:04/04/2012
Priority:NormalDue date:
Assignee:Anoop Saldanha% Done:

0%

Category:-
Target version:1.3beta2

Description

/* reported by rmkml */

alert tcp any 80 -> any any (msg:"test byte_extract"; flow:to_client,established; file_data; content:"abc"; distance:0;
byte_extract:1,-1,ici,relative,big; classtype:web-application-activity; sid:94230265; rev:1;)

suricata output error results:
5/4/2012 -- 01:54:10 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any 80 -> any any (msg:"test
byte_extract"; flow:to_client,established; file_data; content:"abc"; distance:0; byte_extract:1,-1,ici,relative,big;
classtype:web-application-activity; sid:94230265; rev:1;)" from file testsuricata.rules at line 3

At the same time fix negative handling during matching inside extract/test/jump

0001-update-handling-negative-offsets-in-byte_extract.-Al.patch Magnifier (5.04 KB) Anoop Saldanha, 04/05/2012 02:08 PM

History

#2 Updated by Anoop Saldanha about 2 years ago

  • Status changed from New to Resolved

#3 Updated by Victor Julien about 2 years ago

  • Status changed from Resolved to Closed
  • Target version set to 1.3beta2

Applied, thanks Anoop.

Also available in: Atom PDF