Improvement to Unified2File.c in Snort-2.9.8.0 beta

Bill Parker <[email protected]>
Newsgroups gmane.comp.security.ids.snort.devel
Message-ID <CAFrbyQyJo7qTirefD=P0ZyZZsDLaa9_exKBxzKCa++bCODjEAA@mail.gmail.com> 
Hello All,

    In reviewing code in directory 'tools/u2streamer', file
'Unified2File.c', I ran across the comment below:

    /* XXX we should check that we are in the HEADER_READY state */

The patch file below adds the check requested, and additionally checks
a call to lseek() further down in the code which is not checked
for a return value of < 0, indicating error:

=======================================================================

--- Unified2File.c.orig 2015-09-10 09:36:35.103000000 -0700
+++ Unified2File.c      2015-09-10 09:58:34.475000000 -0700
@@ -108,15 +108,19 @@
     if(!u2_file->u2_record)
     {
         /* XXX we should check that we are in the HEADER_READY state */
-        if(!(u2_file->u2_record = (Unified2Record *)calloc(1,
-                        sizeof(Unified2Record))))
-        {
-            fprintf(stderr, "Out of memory (wanted %zu bytes)",
-                    sizeof(Unified2Record));
-            return SF_ENOMEM;
-        }
-        u2_file->read_offset = 0;
-        u2_file->read_status = U2FILE_STATUS_HEADER_READY;
+       if(u2_file->read_status == U2FILE_STATUS_HEADER_READY)
+       {
+           u2_file->u2_record = (Unified2Record *) calloc(1,
sizeof(Unified2Record));
+
+           if(!u2_file->u2_record)
+           {
+               fprintf(stderr, "Out of memory (wanted %zu bytes)",
+                       sizeof(Unified2Record));
+               return SF_ENOMEM;
+           }
+           u2_file->read_offset = 0;
+           u2_file->read_status = U2FILE_STATUS_HEADER_READY;
+       }
     }

     if(u2_file->read_status == U2FILE_STATUS_HEADER_READY
@@ -176,6 +180,13 @@
         {
             /* Seek back to where we started, in case we want to try again
*/
             off_t rval = lseek(u2_file->fd, (0 - bytes_read), SEEK_CUR);
+           if (rval == -1) {
+               fprintf(stderr, "Error on Seek backwards...\n");
+               u2_file->read_errno = errno;
+               u2_file->read_status = U2FILE_STATUS_NOT_READY;
+               return SF_ESEEK;
+           }
+
             fprintf(stderr, "Seek backwards %zu bytes, seek returns %ld",
bytes_read, rval);

             error_count++;

=======================================================================

The patch file below adds a new code for when seek()/lseek()/fseek()
returns a error value:

--- sf_error.h.orig     2015-09-10 10:12:36.391000000 -0700
+++ sf_error.h  2015-09-10 10:13:16.686000000 -0700
@@ -64,6 +64,7 @@
 #define SF_EUSER_LIMIT_REACHED  56  /* Couldn't create user - license
limit reached*/
 #define SF_EDELETE          57  /* Error in deleting file or entry in
memory */
 #define SF_EMEM             58  /* Error in manipulating memory */
+#define SF_ESEEK           70  /* Seek error (file i/o) */
 #define SF_NITRO_DUPLICATE  114 /* duplicate key */

 /**

=======================================================================

The patch file below adds a new descriptive string for the matching
value in sf_error.h:

--- sf_error.c.orig     2015-09-10 10:19:08.505000000 -0700
+++ sf_error.c  2015-09-10 10:20:13.149000000 -0700
@@ -64,6 +64,7 @@
     "Couldn't create user - license limit reached", // 56 -
SF_EUSER_LIMIT_REACHED
     "Error in deleting file or entry in memory",  // 57 - SF_EDELETE
     "Error manipulating memory"  // 58 - SF_EMEM
+    "Seek error"    // 70 - SF_ESEEK
 };

 #define SF_MAX_ERRNUM   (sizeof(SF_errstrings)/sizeof(SF_errstrings[0]))

=======================================================================

I am attaching the patch files to this bug report...

Questions, Comments, Suggestions, Complaints? :)

Bill Parker (wp02855 at gmail dot com) <m00000000!>

------------------------------------------------------------------------------
Monitor Your Dynamic Infrastructure at Any Scale With Datadog!
Get real-time metrics from all of your servers, apps and tools
in one place.
SourceForge users - Click here to start your Free Trial of Datadog now!
http://pubads.g.doubleclick.net/gampad/clk?id=241902991&iu=/4140

_______________________________________________
Snort-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/snort-devel
Archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-devel

Please visit http://blog.snort.org for the latest news about Snort!
sf_error.c.patch (application/octet-stream, 447 B) 
--- sf_error.c.orig	2015-09-10 10:19:08.505000000 -0700
+++ sf_error.c	2015-09-10 10:20:13.149000000 -0700
@@ -64,6 +64,7 @@
     "Couldn't create user - license limit reached", // 56 - SF_EUSER_LIMIT_REACHED
     "Error in deleting file or entry in memory",  // 57 - SF_EDELETE
     "Error manipulating memory"  // 58 - SF_EMEM
+    "Seek error"    // 70 - SF_ESEEK
 };
 
 #define SF_MAX_ERRNUM   (sizeof(SF_errstrings)/sizeof(SF_errstrings[0]))
sf_error.h.patch (application/octet-stream, 474 B) 
--- sf_error.h.orig	2015-09-10 10:12:36.391000000 -0700
+++ sf_error.h	2015-09-10 10:13:16.686000000 -0700
@@ -64,6 +64,7 @@
 #define SF_EUSER_LIMIT_REACHED  56  /* Couldn't create user - license limit reached*/
 #define SF_EDELETE          57  /* Error in deleting file or entry in memory */
 #define SF_EMEM             58  /* Error in manipulating memory */
+#define SF_ESEEK	    70	/* Seek error (file i/o) */
 #define SF_NITRO_DUPLICATE  114 /* duplicate key */
 
 /**
Unified2File.c.patch (application/octet-stream, 1.5 KB) 
--- Unified2File.c.orig	2015-09-10 09:36:35.103000000 -0700
+++ Unified2File.c	2015-09-10 09:58:34.475000000 -0700
@@ -108,15 +108,19 @@
     if(!u2_file->u2_record)
     {
         /* XXX we should check that we are in the HEADER_READY state */
-        if(!(u2_file->u2_record = (Unified2Record *)calloc(1,
-                        sizeof(Unified2Record))))
-        {
-            fprintf(stderr, "Out of memory (wanted %zu bytes)",
-                    sizeof(Unified2Record));
-            return SF_ENOMEM;
-        }
-        u2_file->read_offset = 0;
-        u2_file->read_status = U2FILE_STATUS_HEADER_READY;
+	if(u2_file->read_status == U2FILE_STATUS_HEADER_READY)
+	{
+	    u2_file->u2_record = (Unified2Record *) calloc(1, sizeof(Unified2Record));
+
+	    if(!u2_file->u2_record)
+	    {
+		fprintf(stderr, "Out of memory (wanted %zu bytes)",
+		        sizeof(Unified2Record));
+		return SF_ENOMEM;
+	    }
+	    u2_file->read_offset = 0;
+	    u2_file->read_status = U2FILE_STATUS_HEADER_READY;
+	}
     }
 
     if(u2_file->read_status == U2FILE_STATUS_HEADER_READY
@@ -176,6 +180,13 @@
         {
             /* Seek back to where we started, in case we want to try again */
             off_t rval = lseek(u2_file->fd, (0 - bytes_read), SEEK_CUR);
+	    if (rval == -1) {
+		fprintf(stderr, "Error on Seek backwards...\n");
+		u2_file->read_errno = errno;
+		u2_file->read_status = U2FILE_STATUS_NOT_READY;
+		return SF_ESEEK;
+	    }
+
             fprintf(stderr, "Seek backwards %zu bytes, seek returns %ld", bytes_read, rval);
 
             error_count++;
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.