Re: pkg/45438: regex error in net/nmap

[Alan Barrett <apb%cequrux.com@localhost>]

The following reply was made to PR pkg/45438; it has been noted by GNATS.

From: Alan Barrett <apb%cequrux.com@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: 
Subject: Re: pkg/45438: regex error in net/nmap
Date: Sat, 19 Nov 2011 10:40:00 +0200

 On Fri, 18 Nov 2011, Fredrik Pettai wrote:
 > On Oct 13, 2011, at 13:05 , J=0?rn Clausen wrote:
 >> The diff is a bit lengthy, so I won't include it here. Just 
 >> open nmap-service-probes in vi and do
 >>
 >> :%s/\[\.\([^]]*\)/[\1./g
 >
 > I don't follow, could you please explain what you mean? 
 > Example? (For me, nmap -A -T4 scanme.nmap.org didn't differ w/o 
 > the patch you suggested)
 
 Line 118 of the nmap-service-probes file looks like this:
 
 118 match backdoor m|^220 [Sf.][tu.][nc.][yk.][.F][t.][p.][d.] [0.][w.][n.]
 118 [s.] [j.][0.]\r?\n|i p/Generic Kibuv worm/ i/**BACKDOOR**/ o/Windows/
 
 Some regexp implementations are confused by the "[.F][t.]", thinking
 that it looks like a "collating symbol" as described in
 <http://pubs.opengroup.org/onlinepubs/009695399/basedefs/xbd_chap09.h>.
 
 "    A collating symbol is a collating element enclosed within
 "    bracket-period ( "[." and ".]" ) delimiters.
 
 To avoid this problem, the regexp should be changed to ensure that 
 "." is never the first character inside square brackets.
 
 This problem appears in several places in the file, not only in 
 line 118.  The vi command given earlier
 
     :%s/\[\.\([^]]*\)/[\1./g
 
 will find and fix them all.
 
 --apb (Alan Barrett)