Project

General

Profile

Actions
Copy link

Bug #133

closed

suricata app-layer-htp response Zero-length data chunks are not allowed

Added by rmkml rmkml over 14 years ago. Updated over 14 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Pablo Rincon
Target version:
0.9.0
Affected Versions:
Effort:
Difficulty:
Label:

Description

Hi,
I have downloaded last suricata git version (v0.8.2 release have same pb), and I have this error with joigned pcap file:
[25537] 28/4/2010 -- 13:14:28 - (app-layer-htp.c:406) <Error> (HTPHandleResponseData) -- [ERRCODE: SC_ERR_ALPARSER(56)] - Error in parsing HTTP server response: [1] [htp_response.c] [733] Zero-length data chunks are not allowed
[25537] 28/4/2010 -- 13:14:28 - (app-layer-parser.c:831) <Error> (AppLayerParse) -- [ERRCODE: SC_ERR_ALPARSER(56)] - Error occured in parsing "http" app layer protocol, using network protocol 6, source IP address 10.50.1.208, destination IP address 199.7.71.72, src port 51173 and dst port 80
If anyone have a idea please?
Joigned pcap file (not fuzing, it's a real/live trafic) contains http connection to ocsp_verisign since firefox browser.
Regards
Rmkml

Files

Download all files
exemple_http_ocsp_onlinecertificatestatusprotocol_verisign.pcap (3.54 KB) exemple_http_ocsp_onlinecertificatestatusprotocol_verisign.pcap rmkml rmkml, 04/28/2010 02:46 PM
0001-Do-not-invoke-libhtp-without-data-to-process.patch (1.15 KB) 0001-Do-not-invoke-libhtp-without-data-to-process.patch Avoid passing zero length chunk to htplib Pablo Rincon, 04/28/2010 03:00 PM
0001-fix-bug-133-error-caused-by-seq-mismatch-in-fin_wai.patch (1.67 KB) 0001-fix-bug-133-error-caused-by-seq-mismatch-in-fin_wai.patch Gurvinder Singh, 04/29/2010 03:30 AM
Actions
Copy link

Also available in: Atom PDF