bytejump: don't print errors when matching

When bytejump was told to convert some payload data to int from a
string it would print an error to the screen if the conversion
failed. This is unwanted as the payload is controlled by an attacker
and printing is expensive.
pull/2622/head
Victor Julien 9 years ago
parent 15d26f14e1
commit 3626ecb474

@ -137,18 +137,18 @@ int DetectBytejumpDoMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
extbytes = ByteExtractStringUint64(&val, data->base,
data->nbytes, (const char *)ptr);
if(extbytes <= 0) {
SCLogError(SC_ERR_BYTE_EXTRACT_FAILED,"Error extracting %d bytes "
"of string data: %d", data->nbytes, extbytes);
SCReturnInt(-1);
SCLogDebug("error extracting %d bytes of string data: %d",
data->nbytes, extbytes);
SCReturnInt(0);
}
}
else {
int endianness = (flags & DETECT_BYTEJUMP_LITTLE) ? BYTE_LITTLE_ENDIAN : BYTE_BIG_ENDIAN;
extbytes = ByteExtractUint64(&val, endianness, data->nbytes, ptr);
if (extbytes != data->nbytes) {
SCLogError(SC_ERR_BYTE_EXTRACT_FAILED,"Error extracting %d bytes "
"of numeric data: %d", data->nbytes, extbytes);
SCReturnInt(-1);
SCLogDebug("error extracting %d bytes of numeric data: %d",
data->nbytes, extbytes);
SCReturnInt(0);
}
}

Loading…
Cancel
Save