Snort.org home  
Got Source? About Snort About Sourcefire Snort FAQ
Sourcefire Network Security - the creators of Snort

Snort Forums Archive

Archive Home » Snort Development » Patch for src/mstring.c

Please note that the categories listed below represent an archived version of our forums pages. To view the current version and be able to post and reply to threads, please register and login here to go to the full forums pages.

[ Notice: Full Version of This Topic ]

Patch for src/mstring.c


Posted by DirkDatzert on March 24, 2005 09:02:24

Hi,

I have possible detected a little bug in parsing configuration and rules:

If you have to following option in a rule:

reference: arachnids,123;

multiplie spaces in the referece_system will occure in a database!

I would suggest to patch the mstring function mSplit to strip off leading spaces.

--8<--
--- snort/src/mstring.c 2005-03-24 17:09:53.882541489 +0100
+++ snort/src/mstring.c.dirk 2005-03-24 17:15:16.525558734 +0100
@@ -127,6 +127,10 @@
"[*] Splitting string: %s\n", str);
DebugMessage(DEBUG_PATTERN_MATCH, "curr_str = %d\n", curr_str););

+ /* remove leading whitespace */
+ while(isspace((int) *(str)) && *str)
+ str++;
+
/*
* find the ends of the respective passed strings so our while() loops
* know where to stop
--8<--

Regards,
Dirk