[Snort-Devel] bug in http preprocessor and non ascii characters 2.8.6.1

[matan monitz <mmonitz () gmail com>]

hello
i am encountering runaway uri buffers when inspecting packets with non ascii
characters in the uri
what basically happens is that for some reason if the uri contains non
printable letters (hebrew ansi from IE for instance) the uri buffer gets
filled with header data resulting in false positives
i haven't tested the buffers using the methods described in the recent blog
post but have tested it with custom rules and was able to recreate the bug
is this a known bug or some configuration option i'm missing?
 i can post the test pcaps and rules if needed

------------------------------------------------------------------------------
Colocation vs. Managed Hosting
A question and answer guide to determining the best fit
for your organization - today and in the future.
http://p.sf.net/sfu/internap-sfd2d

_______________________________________________
Snort-devel mailing list
Snort-devel () lists sourceforge net
https://lists.sourceforge.net/lists/listinfo/snort-devel