Snort3: bug with "-z" when it only in config
Meridoff via Snort-devel <[email protected]> Tue, 20 Nov 2018 19:03:55 +0300
| Newsgroups | gmane.comp.security.ids.snort.devel |
|---|---|
| Message-ID | <CAFfuDwy1-gAnrmzOY5XcjwZK7eZCj=ds3Po1QUsOqUK2Ggzxag@mail.gmail.com> |
Hello, when option -z (total instances) is given only in config (snort["-z"]=true), then it equals to 1 (default ?) for some of inspectors/plugins/modules, because they inited between parse_cmd_line and parse_config (where -z lies). Due to this bug/feature for many instances we have access to uninted array p->pp_class.init[slot] in function InspectorManager::thread_init (), when slot > 1 but this array for some inspectors (appid ,telnet ,etc) has length 1 (see PHClass costructor). So we must duplicate "-z" in command line or do not use snort["-z"]=true at all. _______________________________________________ Snort-devel mailing list [email protected] https://lists.snort.org/mailman/listinfo/snort-devel Please visit http://blog.snort.org for the latest news about Snort!