Actions
Bug #4482
opendetect: detect events not in rules, not tested (and not working?)
Affected Versions:
Effort:
Difficulty:
Label:
Description
There is a special class of 'events' that is currently only used by the swf decoder that runs from the detection engine. In case it finds issues during the decompression process in swf, it sets events.
The events are in detect.h
/* event code */
enum {
#ifdef UNITTESTS
DET_CTX_EVENT_TEST,
#endif
FILE_DECODER_EVENT_NO_MEM,
FILE_DECODER_EVENT_INVALID_SWF_LENGTH,
FILE_DECODER_EVENT_INVALID_SWF_VERSION,
FILE_DECODER_EVENT_Z_DATA_ERROR,
FILE_DECODER_EVENT_Z_STREAM_ERROR,
FILE_DECODER_EVENT_Z_BUF_ERROR,
FILE_DECODER_EVENT_Z_UNKNOWN_ERROR,
FILE_DECODER_EVENT_LZMA_DECODER_ERROR,
FILE_DECODER_EVENT_LZMA_MEMLIMIT_ERROR,
FILE_DECODER_EVENT_LZMA_OPTIONS_ERROR,
FILE_DECODER_EVENT_LZMA_FORMAT_ERROR,
FILE_DECODER_EVENT_LZMA_DATA_ERROR,
FILE_DECODER_EVENT_LZMA_BUF_ERROR,
FILE_DECODER_EVENT_LZMA_UNKNOWN_ERROR,
There appear to be no rules we ship for these and have no tests. DetectEngineGetEvents which should be used to get to the set events is not used, so I suspect the code may not work at all.
If this is indeed a bug then we'll need to eval this for backports.
Actions