Project

General

Profile

Actions
Copy link

Bug #445

closed

Byte extract/jump/test doesn't handle negative offsets

Added by Anoop Saldanha over 12 years ago. Updated over 12 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Anoop Saldanha
Target version:
1.3beta2
Affected Versions:
Effort:
Difficulty:
Label:

Description

/* reported by rmkml */

alert tcp any 80 -> any any (msg:"test byte_extract"; flow:to_client,established; file_data; content:"abc"; distance:0;
byte_extract:1,-1,ici,relative,big; classtype:web-application-activity; sid:94230265; rev:1;)

suricata output error results:
5/4/2012 -- 01:54:10 - <Error> - [ERRCODE: SC_ERR_INVALID_SIGNATURE(39)] - error parsing signature "alert tcp any 80 -> any any (msg:"test
byte_extract"; flow:to_client,established; file_data; content:"abc"; distance:0; byte_extract:1,-1,ici,relative,big;
classtype:web-application-activity; sid:94230265; rev:1;)" from file testsuricata.rules at line 3

At the same time fix negative handling during matching inside extract/test/jump

Files

0001-update-handling-negative-offsets-in-byte_extract.-Al.patch (5.04 KB) 0001-update-handling-negative-offsets-in-byte_extract.-Al.patch Anoop Saldanha, 04/05/2012 02:08 PM
Actions
Copy link

Also available in: Atom PDF