Re: Matching PCRE

[Paul Schmehl <pschmehl_lists () tx rr com>]

I suspected as much, so I added "G" after the match boundaries.  We'll see if 
that totally breaks the rule.  Hope not.  :-)

--On Tuesday, January 19, 2010 15:13:46 -0600 Matt Olney 
<molney () sourcefire com> wrote:

> I think greediness may be biting you in the butt...
>
>
> So this would match:
>
>   re> /(\w+).?=.?\1/   <----rough rewrite of your pcre
> data> applee=eapple
>  0: applee=eapple
>  1: apple
> data> sap=bsa
>  0: sap=bsa
>  1: sa
> data> buffalo=uffalo
>  0: uffalo=uffalo
>  1: uffalo
> data> buff=abuf
>  0: buff=abuf
>  1: buf



-- 
Paul Schmehl, Senior Infosec Analyst
As if it wasn't already obvious, my opinions
are my own and not those of my employer.
*******************************************
"It is as useless to argue with those who have
renounced the use of reason as to administer
medication to the dead." Thomas Jefferson


------------------------------------------------------------------------------
Throughout its 18-year history, RSA Conference consistently attracts the
world's best and brightest in the field, creating opportunities for Conference
attendees to learn about information security's most important issues through
interactions with peers, luminaries and emerging and established companies.
http://p.sf.net/sfu/rsaconf-dev2dev
_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-sigs