rendered paste body--- snort-2.8.0/src/decode.c 2007-09-07 14:01:56.000000000 -0400
+++ snort-2.8.0-snaplen/src/decode.c 2007-11-21 10:20:23.000000000 -0500
@@ -2457,27 +2457,30 @@
return;
}
- if (ip_len != len)
+ if( (ip_len != len) && (pv.pkt_snaplen != p->pkth->caplen))
{
if (ip_len > len)
{
#ifdef DEBUG
if (pv.verbose_flag)
ErrorMessage("IP Len field is %d bytes bigger"
- " than captured length.\n"
- " (ip.len: %lu, cap.len: %lu)\n",
- ip_len - len, ip_len, len);
+ " than captured length.\n"
+ " (ip.len: %lu, cap.len: %lu)\n",
+ ip_len - len, ip_len, len);
#endif
if((runMode == MODE_IDS) && pv.decoder_flags.oversized_alert)
{
- SnortEventqAdd(GENERATOR_SNORT_DECODE, DECODE_IPV4_DGRAM_GT_IPH
DR,
- 1, DECODE_CLASS, 3, DECODE_IPV4_DGRAM_GT_IPHDR_STR, 0);
+ SnortEventqAdd(GENERATOR_SNORT_DECODE,
+ DECODE_IPV4_DGRAM_GT_IPHDR,
+ 1, DECODE_CLASS, 3,
+ DECODE_IPV4_DGRAM_GT_IPHDR_STR, 0);
if ((InlineMode()) && pv.decoder_flags.oversized_drop)
{
- DEBUG_WRAP(DebugMessage(DEBUG_DECODE, "Dropping bad packet\
n"););
+ DEBUG_WRAP(DebugMessage(DEBUG_DECODE,
+ "Dropping bad packet\n"););
InlineDrop(p);
}
-
+
}
p->iph = NULL;
@@ -2493,9 +2496,9 @@
#ifdef DEBUG
if (pv.verbose_flag)
ErrorMessage("IP Len field is %d bytes "
- "smaller than captured length.\n"
- " (ip.len: %lu, cap.len: %lu)\n",
- len - ip_len, ip_len, len);
+ "smaller than captured length.\n"
+ " (ip.len: %lu, cap.len: %lu)\n",
+ len - ip_len, ip_len, len);
#endif
}