Merge pull request #1171 in SNORT/snort3 from byte_ops to master

Squashed commit of the following:

commit 1a3f22486d2e1d4c1fad38cab4b0fdbf3f785248
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Wed Mar 28 19:43:03 2018 -0400

    byte_math: allow rvalue == 0 except for division

commit 9767e7c269510c7be9bd57a1c87fecdbbc7a8cda
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Wed Mar 28 19:42:34 2018 -0400

    byte_jump: fix from_beginning

commit 355e31af2644bc060a2b4734e7138f5a61f8c704
Author: Russ Combs (rucombs) <rucombs@cisco.com>
Date:   Wed Mar 28 19:42:03 2018 -0400

    byte_extract: fix cursor update

diff --git a/src/ips_options/ips_byte_extract.cc b/src/ips_options/ips_byte_extract.cc
index e434e6ffac5e537844f8dca1a5c21894d69a6d35..517f607d4fad671ebe0048a83aecee401529a6f1 100644 (file)
--- a/src/ips_options/ips_byte_extract.cc
+++ b/src/ips_options/ips_byte_extract.cc
@@ -217,7 +217,7 @@ IpsOption::EvalStatus ByteExtractOption::eval(Cursor& c, Packet* p)
     SetVarValueByIndex(value, data->var_number);
 
     /* advance cursor */
-    c.add_pos(bytes_read);
+    c.add_pos(data->offset + bytes_read);
 
     /* this rule option always "matches" if the read is performed correctly */
     return MATCH;

diff --git a/src/ips_options/ips_byte_jump.cc b/src/ips_options/ips_byte_jump.cc
index 168a8f6d2d44749898a879407bef9c37ba4833be..e95484486bd8f55bbe4000e3efe1a30995f1a2f9 100644 (file)
--- a/src/ips_options/ips_byte_jump.cc
+++ b/src/ips_options/ips_byte_jump.cc
@@ -233,8 +233,7 @@ IpsOption::EvalStatus ByteJumpOption::eval(Cursor& c, Packet* p)
     }
 
     const uint8_t* const start_ptr = c.buffer();
-    const int dsize = c.size();
-    const uint8_t* const end_ptr = start_ptr + dsize;
+    const uint8_t* const end_ptr = start_ptr + c.size();
     const uint8_t* const base_ptr = offset +
         ((bjd->relative_flag) ? c.start() : start_ptr);
 
@@ -301,20 +300,20 @@ IpsOption::EvalStatus ByteJumpOption::eval(Cursor& c, Packet* p)
         }
     }
 
-    if (!bjd->from_beginning_flag && !bjd->from_end_flag)
-    {
-        jump += payload_bytes_grabbed;
-        jump += c.get_pos();
-    }
+    uint32_t pos;
+
+    if ( bjd->from_beginning_flag )
+        pos = jump;
+
+    else if ( bjd->from_end_flag )
+        pos = c.size() + jump;
 
-    if (bjd->from_end_flag)
-        jump += dsize;
     else
-        jump += offset;
+        pos = c.get_pos() + offset + payload_bytes_grabbed + jump;
 
-    jump += post_offset;
+    pos += post_offset;
 
-    if ( !c.set_pos(jump) )
+    if ( !c.set_pos(pos) )
         return NO_MATCH;
 
     return MATCH;

diff --git a/src/ips_options/ips_byte_math.cc b/src/ips_options/ips_byte_math.cc
index 14456db74882926621f2ae50ec912ea25777bbf8..89dbdb7a258e82c03b7064c2510fe3d652f581b1 100644 (file)
--- a/src/ips_options/ips_byte_math.cc
+++ b/src/ips_options/ips_byte_math.cc
@@ -177,7 +177,7 @@ IpsOption::EvalStatus ByteMathOption::eval(Cursor& c, Packet* p)
     if (config.rvalue_var >= 0 && config.rvalue_var < NUM_IPS_OPTIONS_VARS)
     {
         GetVarValueByIndex(&rvalue, config.rvalue_var);
-        if (rvalue == 0)
+        if (rvalue == 0 and config.oper == BM_DIVIDE)
             return NO_MATCH;
     }
     else