detect: errors for rule with impossible conditions

Such as >255 for an uint8 field

diff --git a/src/detect-engine-uint.c b/src/detect-engine-uint.c
index e67df934dabd2ed2a3d7de82ede870d53196c4b8..2a21c42d9d6699d4efe89b8791b57c345d0ba2a8 100644 (file)
--- a/src/detect-engine-uint.c
+++ b/src/detect-engine-uint.c
@@ -75,6 +75,33 @@ int DetectU32Match(const uint32_t parg, const DetectU32Data *du32)
     return 0;
 }
 
+static int DetectU32Validate(DetectU32Data *du32)
+{
+    switch (du32->mode) {
+        case DETECT_UINT_LT:
+            if (du32->arg1 == 0) {
+                return 1;
+            }
+            break;
+        case DETECT_UINT_GT:
+            if (du32->arg1 == UINT32_MAX) {
+                return 1;
+            }
+            break;
+        case DETECT_UINT_RA:
+            if (du32->arg1 >= du32->arg2) {
+                return 1;
+            }
+            // we need at least one value that can match parg > du32->arg1 && parg < du32->arg2
+            if (du32->arg1 + 1 >= du32->arg2) {
+                return 1;
+            }
+            break;
+        default:
+            break;
+    }
+    return 0;
+}
 
 /**
  * \brief This function is used to parse u32 options passed via some u32 keyword
@@ -211,6 +238,10 @@ DetectU32Data *DetectU32Parse (const char *u32str)
             return NULL;
         }
     }
+    if (DetectU32Validate(&u32da)) {
+        SCLogError(SC_ERR_INVALID_VALUE, "Impossible value for uint32 condition : %s", u32str);
+        return NULL;
+    }
     u32d = SCCalloc(1, sizeof (DetectU32Data));
     if (unlikely(u32d == NULL))
         return NULL;
@@ -292,6 +323,34 @@ int DetectU8Match(const uint8_t parg, const DetectU8Data *du8)
     return 0;
 }
 
+static int DetectU8Validate(DetectU8Data *du8)
+{
+    switch (du8->mode) {
+        case DETECT_UINT_LT:
+            if (du8->arg1 == 0) {
+                return 1;
+            }
+            break;
+        case DETECT_UINT_GT:
+            if (du8->arg1 == UINT8_MAX) {
+                return 1;
+            }
+            break;
+        case DETECT_UINT_RA:
+            if (du8->arg1 >= du8->arg2) {
+                return 1;
+            }
+            // we need at least one value that can match parg > du8->arg1 && parg < du8->arg2
+            if (du8->arg1 + 1 >= du8->arg2) {
+                return 1;
+            }
+            break;
+        default:
+            break;
+    }
+    return 0;
+}
+
 /**
  * \brief This function is used to parse u8 options passed via some u8 keyword
  *
@@ -417,6 +476,10 @@ DetectU8Data *DetectU8Parse (const char *u8str)
             return NULL;
         }
     }
+    if (DetectU8Validate(&u8da)) {
+        SCLogError(SC_ERR_INVALID_VALUE, "Impossible value for uint8 condition : %s", u8str);
+        return NULL;
+    }
     u8d = SCCalloc(1, sizeof (DetectU8Data));
     if (unlikely(u8d == NULL))
         return NULL;