Project

General

Profile

Actions

Bug #7126

closed

decode/base64: Error message on packet path.

Added by Jeff Lucovsky 6 months ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When processing the attached pcap (disable checksum validation), an error message from the packet path is displayed.

Thread 17 "W#15" hit Breakpoint 1, ByteExtractString (res=0x7fffaaa27850, base=0xa, len=0x0, str=0x7fffaaa27890 "4404 LAST", strict=0x1) at util-byte.c:227
227            SCLogError("Extra characters following numeric value");
gdb$ bt
#0  ByteExtractString (res=0x7fffaaa27850, base=0xa, len=0x0, str=0x7fffaaa27890 "4404 LAST", strict=0x1) at util-byte.c:227
#1  0x00005555556b549b in StringParseUint32 (res=0x7fff9d01680c, base=0xa, len=0x0, str=0x7fffaaa27890 "4404 LAST") at util-byte.c:317
#2  0x000055555576e103 in SMTPParseCommandBDAT (state=0x7fff9d0167d0, line=0x7fffaaa279b0) at app-layer-smtp.c:988
#3  0x000055555576e9f2 in SMTPProcessRequest (state=0x7fff9d0167d0, f=0x5555575e8d80, input=0x7fffaaa279c0, line=0x7fffaaa279b0, slice=0x7fffaaa27948) at app-layer-smtp.c:1197
#4  0x000055555576f1f7 in SMTPParse (direction=0x0, f=0x5555575e8d80, state=0x7fff9d0167d0, pstate=0x7fff9d016790, stream_slice=..., thread_data=0x7fff9c50c4d0) at app-layer-smtp.c:1392
#5  0x000055555576f53e in SMTPParseClientRecord (f=0x5555575e8d80, alstate=0x7fff9d0167d0, pstate=0x7fff9d016790, stream_slice=..., local_data=0x7fff9c50c4d0) at app-layer-smtp.c:1454
#6  0x0000555555768034 in AppLayerParserParse (tv=0x555566815c40, alp_tctx=0x7fff9c503490, f=0x5555575e8d80, alproto=0x3, flags=0x4, input=0x7fff9d018b46 "MAIL From:<linux-kernel-owner@vger.kernel.org> BODY=8BITMIME SIZE=4333\r\nRCPT To:<trafficwatcher@foundit.scootmail.com>\r\nBDAT 4404 LAST\r\nReceived: (majordomo@vger.kernel.org) by vger.kernel.org via lis"..., input_len=0xb50) at app-layer-parser.c:1380

Files

smtp-bdat-pipeline-8bitmime.pcap (16.3 KB) smtp-bdat-pipeline-8bitmime.pcap Jeff Lucovsky, 06/28/2024 01:31 PM

Related issues 1 (0 open1 closed)

Related to Suricata - Bug #7200: Suricata[239866]: Error: byte: Extra characters following numeric value [ByteExtractString:util-byte.c:227]ClosedJeff LucovskyActions
Actions #1

Updated by Jeff Lucovsky 6 months ago

  • Status changed from New to In Review
Actions #2

Updated by Victor Julien 5 months ago

  • Related to Bug #7200: Suricata[239866]: Error: byte: Extra characters following numeric value [ByteExtractString:util-byte.c:227] added
Actions #3

Updated by Philippe Antoine 4 months ago

  • Target version changed from TBD to 8.0.0-beta1
Actions #4

Updated by Victor Julien about 1 month ago

@Jeff Lucovsky is this fixed?

Actions #5

Updated by Jeff Lucovsky about 1 month ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF