Snort mailing list archives

Snort3: bug with "-z" when it only in config


From: Meridoff via Snort-devel <snort-devel () lists snort org>
Date: Tue, 20 Nov 2018 19:03:55 +0300

Hello, when option -z (total instances) is given only in config
(snort["-z"]=true),
then it equals to 1 (default ?) for some of inspectors/plugins/modules,
because they inited between parse_cmd_line and parse_config (where -z lies).

Due to this bug/feature for many instances we have access to uninted array
 p->pp_class.init[slot] in function InspectorManager::thread_init (), when
slot > 1 but this array for some inspectors (appid ,telnet ,etc) has length
1 (see PHClass costructor).

So we must duplicate "-z" in command line or do not use snort["-z"]=true at
all.
_______________________________________________
Snort-devel mailing list
Snort-devel () lists snort org
https://lists.snort.org/mailman/listinfo/snort-devel

Please visit http://blog.snort.org for the latest news about Snort!

Current thread: