Integer overflow in perfmonitor preprocessor
Mike Cox <[email protected]>
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CANXgGSLFUyyjb3mMgHPjgLFJKs2Qu1p4v=yaKQG-zQw81PfF-A@mail.gmail.com> |
Just an output bug. Snort 2.9.7.5 is affected and probably previous
versions. In src/preprocessors/spp_perfmonitor.c there is this code:
ParseError("Perfmonitor: Invalid argument to \"%s\". The "
"value must be an integer between 0 and %d.",
PERFMON_ARG__PKT_COUNT, UINT32_MAX)
But the printf '%d' is signed and UINT32_MAX is unsigned so you get output
like this:
Perfmonitor: Invalid argument to "pktcnt". The value must be an integer
between 0 and -1.
Change '%d' to '%u' to fix. Then you get proper output like:
Perfmonitor: Invalid argument to "pktcnt". The value must be an integer
between 0 and 4294967295.
-Mike Cox
------------------------------------------------------------------------------
_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
Please visit http://blog.snort.org for the latest news about Snort!