update

diff --git a/src/file_api/file_mime_decode.cc b/src/file_api/file_mime_decode.cc
index 4359f7e16ae2bfaf5398d0811b96770f9c4e64a3..dcafd928d2d4848e645b1ec2031f7c1e683f865c 100644 (file)
--- a/src/file_api/file_mime_decode.cc
+++ b/src/file_api/file_mime_decode.cc
@@ -56,7 +56,6 @@ void MimeDecode::process_decode_type(const char* start, int length, bool cnt_xf)
             {
                 decode_type = DECODE_B64;
                 decoder = new B64Decode(config->get_b64_depth());
-                detection_depth = config->get_b64_depth();
                 return;
             }
         }
@@ -68,7 +67,6 @@ void MimeDecode::process_decode_type(const char* start, int length, bool cnt_xf)
             {
                 decode_type = DECODE_QP;
                 decoder = new QPDecode(config->get_qp_depth());
-                detection_depth = config->get_qp_depth();
                 return;
             }
         }
@@ -80,7 +78,6 @@ void MimeDecode::process_decode_type(const char* start, int length, bool cnt_xf)
             {
                 decode_type = DECODE_UU;
                 decoder = new UUDecode(config->get_uu_depth());
-                detection_depth = config->get_uu_depth();
                 return;
             }
         }
@@ -90,7 +87,6 @@ void MimeDecode::process_decode_type(const char* start, int length, bool cnt_xf)
     {
         decode_type = DECODE_BITENC;
         decoder = new BitDecode(config->get_bitenc_depth());
-        detection_depth = config->get_bitenc_depth();
         return;
     }
 }
@@ -102,7 +98,7 @@ DecodeResult MimeDecode::decode_data(const uint8_t* start, const uint8_t* end)
 
 int MimeDecode::get_detection_depth()
 {
-    return (decoder?decoder->get_detection_depth(detection_depth):0);
+    return (decoder?decoder->get_detection_depth():0);
 }
 
 int MimeDecode::get_decoded_data(uint8_t** buf,  uint32_t* size)

diff --git a/src/file_api/file_mime_decode.h b/src/file_api/file_mime_decode.h
index 9ec1a069fbf5e73895b62bfeabd2789e8e41614f..0c30cfb95b7a1fc4494d24092745214e2072a0da 100644 (file)
--- a/src/file_api/file_mime_decode.h
+++ b/src/file_api/file_mime_decode.h
@@ -66,8 +66,6 @@ private:
     DecodeType decode_type = DECODE_NONE;
     DecodeConfig* config;
     DataDecode* decoder = NULL;
-    int detection_depth = 0;
-
 };
 
 // Todo: add statistics

diff --git a/src/file_api/file_mime_process.h b/src/file_api/file_mime_process.h
index 6102d2ab9bb2d24fedd8fb93512b857c4e431bf7..5461f282ed3c2dfbe6e7bd19ea409ff37d5737c6 100644 (file)
--- a/src/file_api/file_mime_process.h
+++ b/src/file_api/file_mime_process.h
@@ -81,7 +81,7 @@ private:
     { return 0; }
     virtual int normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data_end)
     { return 0; }
-    virtual void decode_alert(void* decode_state)
+    virtual void decode_alert(MimeDecode* decode_state)
     { }
     virtual void reset_state(void* ssn)
     { }

diff --git a/src/service_inspectors/imap/imap.cc b/src/service_inspectors/imap/imap.cc
index d2ab9526093a00faa9e5fa165d534004335618e8..04463a9d2b12508ccbdd2265a3666b2377c0cee9 100644 (file)
--- a/src/service_inspectors/imap/imap.cc
+++ b/src/service_inspectors/imap/imap.cc
@@ -741,7 +741,7 @@ static void snort_imap(IMAP_PROTO_CONF* config, Packet* p)
     }
 }
 
-void ImapMime::decode_alert(void* ds)
+void ImapMime::decode_alert(MimeDecode* ds)
 {
     MimeDecode* decode_state = (MimeDecode*)ds;
     switch ( decode_state->get_decode_type() )

diff --git a/src/service_inspectors/imap/imap.h b/src/service_inspectors/imap/imap.h
index 9fa5f1190078bb9b1a0d57c038cf2a651929da24..a3b49c128b7aefe9c87c299714509ef1167b2813 100644 (file)
--- a/src/service_inspectors/imap/imap.h
+++ b/src/service_inspectors/imap/imap.h
@@ -150,7 +150,7 @@ class ImapMime : public MimeSession
 {
     using MimeSession::MimeSession;
 private:
-    void decode_alert(void* decode_state) override;
+    void decode_alert(MimeDecode* decode_state) override;
     void reset_state(void* ssn) override;
     bool is_end_of_data(void* ssn) override;
 };

diff --git a/src/service_inspectors/pop/pop.cc b/src/service_inspectors/pop/pop.cc
index b6520e53135e884946f30883b7b64ee9e9c917fe..e449c17d93403fabc97ab5662e3a08ce2d7e5f1e 100644 (file)
--- a/src/service_inspectors/pop/pop.cc
+++ b/src/service_inspectors/pop/pop.cc
@@ -675,7 +675,7 @@ static void snort_pop(POP_PROTO_CONF* config, Packet* p)
     }
 }
 
-void PopMime::decode_alert(void* ds)
+void PopMime::decode_alert(MimeDecode* ds)
 {
     MimeDecode* decode_state = (MimeDecode*)ds;
     switch ( decode_state->get_decode_type() )

diff --git a/src/service_inspectors/pop/pop.h b/src/service_inspectors/pop/pop.h
index 40100c78f14542ff7d79cf84e5469e0996cec58c..50354ac5660745f5a4c3209401625fac9dd10516 100644 (file)
--- a/src/service_inspectors/pop/pop.h
+++ b/src/service_inspectors/pop/pop.h
@@ -105,7 +105,7 @@ class PopMime : public MimeSession
 {
     using MimeSession::MimeSession;
 private:
-    void decode_alert(void* decode_state) override;
+    void decode_alert(MimeDecode* decode_state) override;
     void reset_state(void* ssn) override;
     bool is_end_of_data(void* ssn) override;
 };

diff --git a/src/service_inspectors/smtp/smtp.cc b/src/service_inspectors/smtp/smtp.cc
index a5e3b0b8607e554f6b5add2aa1f58bad56d80cc1..37cdd90f38f2124a9a40e17dd31c158c37402135 100644 (file)
--- a/src/service_inspectors/smtp/smtp.cc
+++ b/src/service_inspectors/smtp/smtp.cc
@@ -1506,7 +1506,7 @@ int SmtpMime::normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data
     return 0;
 }
 
-void SmtpMime::decode_alert(void* ds)
+void SmtpMime::decode_alert(MimeDecode* ds)
 {
     MimeDecode* decode_state = (MimeDecode*)ds;
     switch ( decode_state->get_decode_type() )

diff --git a/src/service_inspectors/smtp/smtp.h b/src/service_inspectors/smtp/smtp.h
index 15eef2dbccc146e9f80348a78777289042021931..38d736139d073e1739e366ab3253bb3bddef6767 100644 (file)
--- a/src/service_inspectors/smtp/smtp.h
+++ b/src/service_inspectors/smtp/smtp.h
@@ -150,7 +150,7 @@ private:
     int handle_header_line(void* conf, const uint8_t* ptr, const uint8_t* eol,
         int max_header_len) override;
     int normalize_data(void* conf, const uint8_t* ptr, const uint8_t* data_end) override;
-    void decode_alert(void* decode_state) override;
+    void decode_alert(MimeDecode* decode_state) override;
     void reset_state(void* ssn) override;
     bool is_end_of_data(void* ssn) override;
 };

diff --git a/src/utils/sf_email_attach_decode.cc b/src/utils/sf_email_attach_decode.cc
index 8fba8222e2766b2c832a28e34040df46981bd4fa..d04c5ff6b5c529d043cf9444e8ea66d439a029e4 100644 (file)
--- a/src/utils/sf_email_attach_decode.cc
+++ b/src/utils/sf_email_attach_decode.cc
@@ -45,13 +45,11 @@ void DataDecode::reset_decode_state()
     clear_prev_encode_buf();
 }
 
-DecodeResult B64Decode::decode_data(const uint8_t* start, const uint8_t* end)
-{
-    uint32_t encode_avail = 0, decode_avail = 0;
-    uint32_t act_encode_size = 0, act_decode_size = 0;
-    uint32_t prev_bytes = 0;
-    uint32_t i = 0;
 
+// 1. Stop decoding when we have reached either the decode depth or encode depth.
+// 2. Stop decoding when we are out of memory
+bool DataDecode::is_buffer_available(uint32_t& encode_avail, uint32_t& decode_avail)
+{
     if (!(encode_depth))
     {
         encode_avail = decode_avail = buf_size;
@@ -62,35 +60,53 @@ DecodeResult B64Decode::decode_data(const uint8_t* start, const uint8_t* end)
         decode_avail = decode_depth - decode_bytes_read;
     }
 
-    /* 1. Stop decoding when we have reached either the decode depth or encode depth.
-     * 2. Stop decoding when we are out of memory */
     if (encode_avail ==0 || decode_avail ==0 ||
         (!encodeBuf) || (!decodeBuf))
     {
         reset_decode_state();
-        return DECODE_EXCEEDED;
+        return false;
     }
 
+    return true;
+}
+
+void DataDecode::resume_decode(uint32_t& encode_avail, uint32_t& prev_bytes)
+{
+    uint32_t i = 0;
+
     /*The non decoded encoded data in the previous packet is required for successful decoding
-     * in case of base64 data spanned across packets*/
-    if ( prev_encoded_bytes )
-    {
-        if (prev_encoded_bytes > encode_avail)
-            prev_encoded_bytes = encode_avail;
+     * in case of data spanned across packets*/
+
+    if ( !prev_encoded_bytes )
+        return;
 
-        if (prev_encoded_buf)
+    if (prev_encoded_bytes > encode_avail)
+        prev_encoded_bytes = encode_avail;
+
+    if (prev_encoded_buf)
+    {
+        prev_bytes = prev_encoded_bytes;
+        encode_avail = encode_avail - prev_bytes;
+        while (prev_encoded_bytes)
         {
-            prev_bytes = prev_encoded_bytes;
-            encode_avail = encode_avail - prev_bytes;
-            while (prev_encoded_bytes)
-            {
-                /* Since this data cannot be more than 3 bytes*/
-                encodeBuf[i] = prev_encoded_buf[i];
-                i++;
-                prev_encoded_bytes--;
-            }
+            encodeBuf[i] = prev_encoded_buf[i];
+            i++;
+            prev_encoded_bytes--;
         }
     }
+}
+
+DecodeResult B64Decode::decode_data(const uint8_t* start, const uint8_t* end)
+{
+    uint32_t encode_avail = 0, decode_avail = 0;
+    uint32_t act_encode_size = 0, act_decode_size = 0;
+    uint32_t prev_bytes = 0;
+    uint32_t i = 0;
+
+    if (!is_buffer_available(encode_avail, decode_avail))
+        return DECODE_EXCEEDED;
+
+    resume_decode(encode_avail, prev_bytes);
 
     if (sf_strip_CRLF(start, (end-start), encodeBuf + prev_bytes, encode_avail,
         &act_encode_size) != 0)
@@ -135,59 +151,16 @@ DecodeResult B64Decode::decode_data(const uint8_t* start, const uint8_t* end)
 DecodeResult QPDecode::decode_data(const uint8_t* start, const uint8_t* end)
 {
     uint32_t encode_avail = 0, decode_avail = 0;
-    uint8_t* encode_buf, * decode_buf;
     uint32_t act_encode_size = 0, act_decode_size = 0, bytes_read = 0;
     uint32_t prev_bytes = 0;
     uint32_t i = 0;
 
-    if (!(encode_depth))
-    {
-        encode_avail = decode_avail = buf_size;
-    }
-    else if ((encode_depth) < 0)
-    {
-        return DECODE_EXCEEDED;
-    }
-    else
-    {
-        encode_avail = encode_depth - encode_bytes_read;
-        decode_avail = decode_depth - decode_bytes_read;
-    }
-
-    encode_buf = encodeBuf;
-    decode_buf = decodeBuf;
-
-    /* 1. Stop decoding when we have reached either the decode depth or encode depth.
-     * 2. Stop decoding when we are out of memory */
-    if (encode_avail ==0 || decode_avail ==0 ||
-        (!encode_buf) || (!decode_buf))
-    {
-        reset_decode_state();
+    if (!is_buffer_available(encode_avail, decode_avail))
         return DECODE_EXCEEDED;
-    }
-
-    /*The non decoded encoded data in the previous packet is required for successful decoding
-     * in case of base64 data spanned across packets*/
-    if ( prev_encoded_bytes )
-    {
-        if (prev_encoded_bytes > encode_avail)
-            prev_encoded_bytes = encode_avail;
 
-        if (prev_encoded_buf)
-        {
-            prev_bytes = prev_encoded_bytes;
-            encode_avail = encode_avail - prev_bytes;
-            while (prev_encoded_bytes)
-            {
-                /* Since this data cannot be more than 3 bytes*/
-                encode_buf[i] = prev_encoded_buf[i];
-                i++;
-                prev_encoded_bytes--;
-            }
-        }
-    }
+    resume_decode(encode_avail, prev_bytes);
 
-    if (sf_strip_LWS(start, (end-start), encode_buf + prev_bytes, encode_avail,
+    if (sf_strip_LWS(start, (end-start), encodeBuf + prev_bytes, encode_avail,
         &act_encode_size) != 0)
     {
         reset_decode_state();
@@ -196,7 +169,7 @@ DecodeResult QPDecode::decode_data(const uint8_t* start, const uint8_t* end)
 
     act_encode_size = act_encode_size + prev_bytes;
 
-    if (sf_qpdecode((char*)encode_buf, act_encode_size, (char*)decode_buf, decode_avail,
+    if (sf_qpdecode((char*)encodeBuf, act_encode_size, (char*)decodeBuf, decode_avail,
         &bytes_read, &act_decode_size) != 0)
     {
         reset_decode_state();
@@ -211,11 +184,11 @@ DecodeResult QPDecode::decode_data(const uint8_t* start, const uint8_t* end)
     if (bytes_read < act_encode_size)
     {
         prev_encoded_bytes = (act_encode_size - bytes_read);
-        prev_encoded_buf = encode_buf + bytes_read;
+        prev_encoded_buf = encodeBuf + bytes_read;
         act_encode_size = bytes_read;
     }
 
-    decodePtr = decode_buf;
+    decodePtr = decodeBuf;
     decoded_bytes = act_decode_size;
     encode_bytes_read += act_encode_size;
     decode_bytes_read += act_decode_size;
@@ -232,59 +205,14 @@ void UUDecode::reset_decode_state()
 DecodeResult UUDecode::decode_data(const uint8_t* start, const uint8_t* end)
 {
     uint32_t encode_avail = 0, decode_avail = 0;
-    uint8_t* encode_buf, * decode_buf;
     uint32_t act_encode_size = 0, act_decode_size = 0, bytes_read = 0;
     uint32_t prev_bytes = 0;
     uint32_t i = 0;
 
-    if (!(encode_depth))
-    {
-        encode_avail = decode_avail = buf_size;
-    }
-    else if ((encode_depth) < 0)
-    {
-        begin_found = false;
-        return DECODE_EXCEEDED;
-    }
-    else
-    {
-        encode_avail = encode_depth - encode_bytes_read;
-        decode_avail = decode_depth - decode_bytes_read;
-    }
-
-    encode_buf = encodeBuf;
-    decode_buf = decodeBuf;
-
-    /* 1. Stop decoding when we have reached either the decode depth or encode depth.
-     * 2. Stop decoding when we are out of memory */
-    if (encode_avail ==0 || decode_avail ==0 ||
-        (!encode_buf) || (!decode_buf))
-    {
-        begin_found = false;
-        reset_decode_state();
-        return DECODE_EXCEEDED;
-    }
-
-    /*The non decoded encoded data in the previous packet is required for successful decoding
-     * in case of base64 data spanned across packets*/
-    if ( prev_encoded_bytes )
-    {
-        if (prev_encoded_bytes > encode_avail)
-            prev_encoded_bytes = encode_avail;
+    if (!is_buffer_available(encode_avail, decode_avail))
+           return DECODE_EXCEEDED;
 
-        if (prev_encoded_buf)
-        {
-            prev_bytes = prev_encoded_bytes;
-            encode_avail = encode_avail - prev_bytes;
-            while (prev_encoded_bytes)
-            {
-                /* Since this data cannot be more than 3 bytes*/
-                encode_buf[i] = prev_encoded_buf[i];
-                i++;
-                prev_encoded_bytes--;
-            }
-        }
-    }
+    resume_decode(encode_avail, prev_bytes);
 
     if ((uint32_t)(end- start) > encode_avail)
         act_encode_size = encode_avail;
@@ -293,7 +221,7 @@ DecodeResult UUDecode::decode_data(const uint8_t* start, const uint8_t* end)
 
     if (encode_avail > 0)
     {
-        if (SafeMemcpy((encode_buf + prev_bytes), start, act_encode_size, encode_buf, (encode_buf+
+        if (SafeMemcpy((encodeBuf + prev_bytes), start, act_encode_size, encodeBuf, (encodeBuf+
             encode_avail + prev_bytes)) != SAFEMEM_SUCCESS)
         {
             reset_decode_state();
@@ -303,7 +231,7 @@ DecodeResult UUDecode::decode_data(const uint8_t* start, const uint8_t* end)
 
     act_encode_size = act_encode_size + prev_bytes;
 
-    if (sf_uudecode(encode_buf, act_encode_size, decode_buf, decode_avail, &bytes_read,
+    if (sf_uudecode(encodeBuf, act_encode_size, decodeBuf, decode_avail, &bytes_read,
         &act_decode_size,
         &(begin_found), &(end_found)) != 0)
     {
@@ -328,12 +256,12 @@ DecodeResult UUDecode::decode_data(const uint8_t* start, const uint8_t* end)
     if (bytes_read < act_encode_size)
     {
         prev_encoded_bytes = (act_encode_size - bytes_read);
-        prev_encoded_buf = encode_buf + bytes_read;
+        prev_encoded_buf = encodeBuf + bytes_read;
         act_encode_size = bytes_read;
     }
 
+    decodePtr = decodeBuf;
     decoded_bytes = act_decode_size;
-    decodePtr = decode_buf;
     encode_bytes_read += act_encode_size;
     decode_bytes_read += act_decode_size;
 
@@ -351,7 +279,6 @@ DecodeResult BitDecode::decode_data(const uint8_t* start, const uint8_t* end)
     {
         bytes_avail = buf_size;
     }
-    // FIXIT-L this check on start should be obviated by use better member functions
     else if ( decode_depth < 0 )
     {
         return DECODE_EXCEEDED;
@@ -385,20 +312,20 @@ DecodeResult BitDecode::decode_data(const uint8_t* start, const uint8_t* end)
     return DECODE_SUCCESS;
 }
 
-int DataDecode::get_detection_depth(int depth)
+int DataDecode::get_detection_depth()
 {
     // unlimited
-    if (!depth)
+    if (!decode_depth)
         return decoded_bytes;
     // exceeded depth before (decode_bytes_read has been updated)
-    else if (depth < decode_bytes_read - decoded_bytes)
+    else if (decode_depth < decode_bytes_read - decoded_bytes)
         return 0;
     // lower than depth
-    else if (depth > decode_bytes_read)
+    else if (decode_depth > decode_bytes_read)
         return decoded_bytes;
     // cut off
     else
-        return (depth + decoded_bytes - decode_bytes_read);
+        return (decode_depth + decoded_bytes - decode_bytes_read);
 }
 
 int DataDecode::get_decoded_data(uint8_t** buf,  uint32_t* size)
@@ -432,17 +359,16 @@ DataDecode::DataDecode(int max_depth)
     if (max_depth < 0)
         return;
 
-    work_buffer = (uint8_t*)SnortAlloc(2*buf_size);
-    encodeBuf = (uint8_t*)work_buffer;
-    decodeBuf = (uint8_t*)work_buffer + buf_size;
-
-
+    encodeBuf = (uint8_t*)SnortAlloc(buf_size);
+    decodeBuf = (uint8_t*)SnortAlloc(buf_size);
 }
 
 DataDecode::~DataDecode()
 {
-    if (work_buffer)
-        free(work_buffer);
+    if (encodeBuf)
+        free(encodeBuf);
+    if (decodeBuf)
+        free(decodeBuf);
 }
 
 int sf_qpdecode(char* src, uint32_t slen, char* dst, uint32_t dlen, uint32_t* bytes_read,

diff --git a/src/utils/sf_email_attach_decode.h b/src/utils/sf_email_attach_decode.h
index a7974409174f492643997e812e2b6558558a2e84..2eb488adcdc5413059086659ee765cf8d352c64e 100644 (file)
--- a/src/utils/sf_email_attach_decode.h
+++ b/src/utils/sf_email_attach_decode.h
@@ -48,24 +48,23 @@ public:
 
     void reset_decoded_bytes();
     virtual void reset_decode_state();
-    int get_detection_depth(int depth);
+    int get_detection_depth();
 
 protected:
-    uint8_t* work_buffer = NULL;
-    uint32_t prev_encoded_bytes;
     uint32_t decoded_bytes = 0;
     uint32_t buf_size;
+    uint32_t prev_encoded_bytes;
     uint8_t* prev_encoded_buf;
-    uint8_t* encodeBuf;
-    uint8_t* decodeBuf;
-    uint8_t* decodePtr = NULL;
+    uint8_t* encodeBuf = nullptr;
+    uint8_t* decodeBuf = nullptr;
+    uint8_t* decodePtr = nullptr;
     uint32_t encode_bytes_read;
     uint32_t decode_bytes_read;
     int encode_depth;
     int decode_depth;
-    bool check_buffer();
+    bool is_buffer_available(uint32_t& encode_avail, uint32_t& decode_avail);
+    void resume_decode(uint32_t& encode_avail, uint32_t& prev_bytes);
     inline void clear_prev_encode_buf();
-
 };
 
 class B64Decode:public DataDecode