From: Josh <jrosenba@cisco.com>
Date: Thu, 6 Nov 2014 20:30:24 +0000 (-0600)
Subject: fixing Codec IPv4 alert and an incorrectly set codec Flag
X-Git-Tag: 3.0.0-233~1211^2~22
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c8ce756bc9d4764f20a1833609e1b20045cde35c;p=thirdparty%2Fsnort3.git

fixing Codec IPv4 alert and an incorrectly set codec Flag
---

diff --git a/src/codecs/ip/cd_ipv4.cc b/src/codecs/ip/cd_ipv4.cc
index 927acad1e..9a1f49655 100644
--- a/src/codecs/ip/cd_ipv4.cc
+++ b/src/codecs/ip/cd_ipv4.cc
@@ -421,7 +421,6 @@ static inline void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec,
 {
 
     /* Yes, it's an ICMP-related vuln in IP options. */
-    uint8_t length, pointer;
     int cnt = 0;
 
 
@@ -432,13 +431,19 @@ static inline void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec,
     {
         ++cnt;
 
-        if (opt.code == ip::IPOptionCodes::RR)
+        switch(opt.code)
         {
-            length = opt.len;
+        case ip::IPOptionCodes::EOL:
+            --cnt;
+            break;
+
+        case ip::IPOptionCodes::RR:
+        {
+            const uint8_t length = opt.len;
             if (length < 3)
                 continue;
 
-            pointer = opt.data[0];
+            uint8_t pointer = opt.data[0];
 
             /* If the pointer goes past the end of the data, then the data
                is full. That's okay. */
@@ -448,14 +453,16 @@ static inline void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec,
                bytes, alert. */
             if (((length + 1) - pointer) % 4)
                 codec_events::decoder_event(codec, DECODE_ICMP_DOS_ATTEMPT);
+
+            break;
         }
-        else if (opt.code == ip::IPOptionCodes::TS)
+        case ip::IPOptionCodes::TS:
         {
-            length = opt.get_len();
+            const uint8_t length = opt.get_len();
             if (length < 2)
                 continue;
 
-            pointer = opt.data[0];
+            uint8_t pointer = opt.data[0];
 
             /* If the pointer goes past the end of the data, then the data
                is full. That's okay. */
@@ -470,6 +477,11 @@ static inline void IPMiscTests(const IP4Hdr* const ip4h, const CodecData& codec,
             if ((opt.data[1] & 0x01) && /* address flag */
                (((length + 1) - pointer) % 8))
                 codec_events::decoder_event(codec, DECODE_ICMP_DOS_ATTEMPT);
+
+            break;
+        }
+        default:
+                break;
         }
     }
 
diff --git a/src/protocols/packet_manager.cc b/src/protocols/packet_manager.cc
index a26e92df5..9a75ff66e 100644
--- a/src/protocols/packet_manager.cc
+++ b/src/protocols/packet_manager.cc
@@ -167,14 +167,6 @@ void PacketManager::decode(
     uint16_t prev_prot_id = FINISHED_DECODE;
     uint8_t mapped_prot = CodecManager::grinder;
 
-    // initialize all Packet information
-    memset(p, 0, PKT_ZERO_LEN);
-    p->pkth = pkthdr;
-    p->pkt = pkt;
-    p->ptrs.reset();
-    layer::set_packet_pointer(p);
-
-
     RawData raw;
     raw.data = pkt;
     raw.len = pkthdr->caplen;
@@ -183,6 +175,15 @@ void PacketManager::decode(
     if (p->packet_flags & PKT_REBUILT_STREAM)
         codec_data.codec_flags |= CODEC_STREAM_REBUILT;
 
+
+    // initialize all Packet information
+    memset(p, 0, PKT_ZERO_LEN);
+    p->pkth = pkthdr;
+    p->pkt = pkt;
+    p->ptrs.reset();
+    layer::set_packet_pointer(p);
+
+
     MODULE_PROFILE_START(decodePerfStats);
     s_stats[total_processed]++;