Re: Integer overflow in perfmonitor preprocessor

Mike Cox <[email protected]>
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <CANXgGSLNRuStgPs5nVLuwpAC2Bz2bD=t4nEYSuYQrm4ud+TvDA@mail.gmail.com>
Also related to the perfmonitor -- the manual says, for 'max_file_size',
"The minimum is 4096 bytes and the maximum is 2147483648 bytes" but there
is an off-by-one error because that maximum is not accepted by Snort:

Perfmonitor:  Invalid argument to "max_file_size".  The value must be
an integer between 4096 and 2147483647.

-Mike Cox



On Wed, Aug 5, 2015 at 12:07 PM, Hui cao <[email protected]> wrote:

> Hi Mike,
>
> Thanks for reporting this issue. We will fix this issue the future release.
>
> Best,
> Hui.
>
>
> On 08/05/2015 11:48 AM, Mike Cox wrote:
>
> Just an output bug.  Snort 2.9.7.5 is affected and probably previous
> versions. In src/preprocessors/spp_perfmonitor.c there is this code:
>
>                 ParseError("Perfmonitor:  Invalid argument to \"%s\".  The
> "
>                         "value must be an integer between 0 and %d.",
>                         PERFMON_ARG__PKT_COUNT, UINT32_MAX)
>
> But the printf '%d' is signed and UINT32_MAX is unsigned so you get output
> like this:
>
> Perfmonitor:  Invalid argument to "pktcnt".  The value must be an integer
> between 0 and -1.
>
> Change '%d' to '%u' to fix.  Then you get proper output like:
>
> Perfmonitor:  Invalid argument to "pktcnt".  The value must be an integer
> between 0 and 4294967295.
>
> -Mike Cox
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Snort-devel mailing [email protected]://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>
>
>
>
> ------------------------------------------------------------------------------
>
> _______________________________________________
> Snort-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/snort-devel
> Archive:
> http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel
>
> Please visit http://blog.snort.org for the latest news about Snort!
>

------------------------------------------------------------------------------

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.