[Oisf-devel] new segfault on suricata v1.4 because wrong conf

[Peter Manev]

On Wed, Dec 26, 2012 at 11:20 AM, Nikolay Denev <ndenev at gmail.com> wrote:

> On Dec 26, 2012, at 11:12 AM, Peter Manev <petermanev at gmail.com> wrote:
>
>
>
> On Tue, Dec 25, 2012 at 11:37 PM, rmkml <rmkml at yahoo.fr> wrote:
>
>> Hi,
>>
>> First, Merry Christmas everyone!
>>
>> I have a new segfault on Suricata v1.4 with my wrong conf like this:
>>
>> # comment good conf:
>> # HTTPS_PORTS: 443
>> # and enable wrong conf:
>>  HTTPS_PORTS: [443,A]
>>
>> cause segfault. (yes Im missed two ")
>>
>> Regards
>> Rmkml
>>
>> http://twitter.com/rmkml
>> ______________________________**_________________
>> Suricata IDS Devel mailing list: oisf-devel@**openinfosecfoundation.org<oisf-devel at openinfosecfoundation.org>
>> Site: http://suricata-ids.org | Participate: http://suricata-ids.org/**
>> participate/ <http://suricata-ids.org/participate/>
>> List: https://lists.**openinfosecfoundation.org/**
>> mailman/listinfo/oisf-devel<https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel>
>> Redmine: https://redmine.**openinfosecfoundation.org/<https://redmine.openinfosecfoundation.org/>
>>
>
> Hi rmkml,
>
> Merry Christmas to you to.
>
> so is the segfault because of the missing two "" or is it because of the
> "A" ?
>
> thank you
>
>
> --
> Regards,
> Peter Manev
> _______________________________________________
> Suricata IDS Devel mailing list: oisf-devel at openinfosecfoundation.org
> Site: http://suricata-ids.org | Participate:
> http://suricata-ids.org/participate/
> List: https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-devel
> Redmine: https://redmine.openinfosecfoundation.org/
>
>
> Hi,
>
> I had similar segfault when adding only numeric ports, which disappeared
> when I added the quotes.
>
>
> Hi,
So does this happen only on PORT variables?

It looks we have two issues here:
1. one is  - seg fault if there are no quotes on variables
2 "A" - alfa characters in the variables value, that is not a defined
variable itself (or an empty one).

is this correct?

Thank you

-- 
Regards,
Peter Manev
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-devel/attachments/20121226/ef5b499a/attachment-0002.html>