Re: Integer overflow in perfmonitor preprocessor

Hui cao <[email protected]>
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <[email protected]>
Hi Mike,

Thanks for reporting this issue. We will fix this issue the future release.

Best,
Hui.

On 08/05/2015 11:48 AM, Mike Cox wrote:
> Just an output bug.  Snort 2.9.7.5 is affected and probably previous 
> versions. In src/preprocessors/spp_perfmonitor.c there is this code:
>
> ParseError("Perfmonitor:  Invalid argument to \"%s\".  The "
>                         "value must be an integer between 0 and %d.",
>                         PERFMON_ARG__PKT_COUNT, UINT32_MAX)
>
> But the printf '%d' is signed and UINT32_MAX is unsigned so you get 
> output like this:
>
> Perfmonitor:  Invalid argument to "pktcnt".  The value must be an 
> integer between 0 and -1.
>
> Change '%d' to '%u' to fix.  Then you get proper output like:
>
> Perfmonitor: Invalid argument to "pktcnt".  The value must be an 
> integer between 0 and 4294967295.
>
> -Mike Cox
>
>
> ------------------------------------------------------------------------------
>
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!

------------------------------------------------------------------------------

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.