[Prelude Hybrid IDS] #226: prelude-lml segfault on rule error

#226: prelude-lml segfault on rule error
-------------------------------+--------------------------------------------
 Reporter:  [email protected]  |       Owner:  yoann
     Type:  defect             |      Status:  new  
 Priority:  normal             |   Milestone:       
Component:  prelude-lml        |     Version:  0.9  
 Severity:  normal             |    Keywords:       
-------------------------------+--------------------------------------------
 I have the following rule in prelude-lml:

 {{{
 regex=message received; \
         add_context=MESSAGE_RECEIVED; \
         silent; \
         last;

 regex=IP = (\S+); \
         require_context=MESSAGE_RECEIVED; \
         source(0).node.address(>>).address = $1; \
         last;
 }}}

 Now I add the following message to the log file I'm monitoring:

 {{{
 message received
 IP = 1.2.3.4
 }}}

 This results in a segfault of prelude-lml:

 {{{
 - /tmp/test.log: Metadata available, starting log analyzis at offset
 18341.
 prelude-lml.c:lml_dispatch_log:225: [LOG] message received
 could not match prefix against log entry: message received.
 pcre-mod.c:pcre_context_new:998: [MESSAGE_RECEIVED]: creating context
 (expire=60s).
 prelude-lml.c:lml_dispatch_log:225: [LOG] IP = 1.2.3.4
 could not match prefix against log entry: IP = 1.2.3.4.
 Segmentation fault
 }}}

 The rule works as expected when I change
 source(0).node.address(>>).address to
 source(>>).node.address(>>).address.

 My version:

 {{{
 [root@blah ~]# prelude-lml --version
 prelude-lml-0.9.9
 }}}

-- 
Ticket URL: <https://trac.prelude-ids.org/ticket/226>
Prelude Hybrid IDS <http://www.prelude-ids.org>
The Prelude Hybrid Intrusion Detection System suite
_______________________________________________
Prelude-devel site list
[email protected]
http://www.prelude-ids.org/mailman/listinfo/prelude-devel