http: make client and server body inspection more robust in cases where realloc fails

diff --git a/src/detect-engine-hcbd.c b/src/detect-engine-hcbd.c
index 6dae89ed818f0613fb72e066e0d64b70fc65b2d7..50d0d0f01f81d840c5ff37c34015ed81ee033271 100644 (file)
--- a/src/detect-engine-hcbd.c
+++ b/src/detect-engine-hcbd.c
@@ -97,10 +97,12 @@ static void DetectEngineBufferHttpClientBodies(DetectEngineCtx *de_ctx,
     size_t txs = list_size(htp_state->connp->conn->transactions) - tmp_idx;
     /* no transactions?!  cool.  get out of here */
     if (txs == 0) {
+        det_ctx->hcbd_buffers_list_len = 0;
         goto end;
     } else if (txs > det_ctx->hcbd_buffers_list_len) {
         det_ctx->hcbd = SCRealloc(det_ctx->hcbd, txs * sizeof(HttpReassembledBody));
         if (det_ctx->hcbd == NULL) {
+            det_ctx->hcbd_buffers_list_len = 0;
             goto end;
         }
 
@@ -233,14 +235,16 @@ int DetectEngineRunHttpClientBodyMpm(DetectEngineCtx *de_ctx,
     DetectEngineBufferHttpClientBodies(de_ctx, det_ctx, f, htp_state);
     FLOWLOCK_UNLOCK(f);
 
-    for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
-        if (det_ctx->hcbd[i].buffer_len == 0)
-            continue;
+    if (det_ctx->hcbd != NULL && det_ctx->hcbd_buffers_list_len) {
+        for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
+            if (det_ctx->hcbd[i].buffer_len == 0)
+                continue;
 
-        cnt += HttpClientBodyPatternSearch(det_ctx,
-                                           det_ctx->hcbd[i].buffer,
-                                           det_ctx->hcbd[i].buffer_len,
-                                           flags);
+            cnt += HttpClientBodyPatternSearch(det_ctx,
+                    det_ctx->hcbd[i].buffer,
+                    det_ctx->hcbd[i].buffer_len,
+                    flags);
+        }
     }
 
     return cnt;
@@ -272,24 +276,26 @@ int DetectEngineInspectHttpClientBody(DetectEngineCtx *de_ctx,
     DetectEngineBufferHttpClientBodies(de_ctx, det_ctx, f, alstate);
     FLOWLOCK_UNLOCK(f);
 
-    for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
-        uint8_t *hcbd_buffer = det_ctx->hcbd[i].buffer;
-        uint32_t hcbd_buffer_len = det_ctx->hcbd[i].buffer_len;
-
-        if (hcbd_buffer == NULL || hcbd_buffer_len == 0)
-            continue;
-
-        det_ctx->buffer_offset = 0;
-        det_ctx->discontinue_matching = 0;
-        det_ctx->inspection_recursion_counter = 0;
-
-        r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH],
-                                          f,
-                                          hcbd_buffer,
-                                          hcbd_buffer_len,
-                                          DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCBD, NULL);
-        if (r == 1) {
-            break;
+    if (det_ctx->hcbd != NULL && det_ctx->hcbd_buffers_list_len) {
+        for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
+            uint8_t *hcbd_buffer = det_ctx->hcbd[i].buffer;
+            uint32_t hcbd_buffer_len = det_ctx->hcbd[i].buffer_len;
+
+            if (hcbd_buffer == NULL || hcbd_buffer_len == 0)
+                continue;
+
+            det_ctx->buffer_offset = 0;
+            det_ctx->discontinue_matching = 0;
+            det_ctx->inspection_recursion_counter = 0;
+
+            r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HCBDMATCH],
+                    f,
+                    hcbd_buffer,
+                    hcbd_buffer_len,
+                    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HCBD, NULL);
+            if (r == 1) {
+                break;
+            }
         }
     }
 
@@ -304,8 +310,10 @@ int DetectEngineInspectHttpClientBody(DetectEngineCtx *de_ctx,
 void DetectEngineCleanHCBDBuffers(DetectEngineThreadCtx *det_ctx)
 {
     int i;
-    for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
-        det_ctx->hcbd[i].buffer_len = 0;
+    if (det_ctx->hcbd != NULL && det_ctx->hcbd_buffers_list_len) {
+        for (i = 0; i < det_ctx->hcbd_buffers_list_len; i++) {
+            det_ctx->hcbd[i].buffer_len = 0;
+        }
     }
     return;
 }

diff --git a/src/detect-engine-hsbd.c b/src/detect-engine-hsbd.c
index d7a2c708ce60309c79f88d4200c27358f2f6df82..ec9c4464b9771cb1ef6af5907071bd715f325c69 100644 (file)
--- a/src/detect-engine-hsbd.c
+++ b/src/detect-engine-hsbd.c
@@ -98,10 +98,12 @@ static void DetectEngineBufferHttpServerBodies(DetectEngineCtx *de_ctx,
     size_t txs = list_size(htp_state->connp->conn->transactions) - tmp_idx;
     /* no transactions?!  cool.  get out of here */
     if (txs == 0) {
+        det_ctx->hsbd_buffers_list_len = 0;
         goto end;
     } else if (txs > det_ctx->hsbd_buffers_list_len) {
         det_ctx->hsbd = SCRealloc(det_ctx->hsbd, txs * sizeof(HttpReassembledBody));
         if (det_ctx->hsbd == NULL) {
+            det_ctx->hsbd_buffers_list_len = 0;
             goto end;
         }
 
@@ -229,14 +231,16 @@ int DetectEngineRunHttpServerBodyMpm(DetectEngineCtx *de_ctx,
     DetectEngineBufferHttpServerBodies(de_ctx, det_ctx, f, htp_state);
     FLOWLOCK_UNLOCK(f);
 
-    for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
-        if (det_ctx->hsbd[i].buffer_len == 0)
-            continue;
+    if (det_ctx->hsbd != NULL && det_ctx->hsbd_buffers_list_len) {
+        for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
+            if (det_ctx->hsbd[i].buffer_len == 0)
+                continue;
 
-        cnt += HttpServerBodyPatternSearch(det_ctx,
-                                           det_ctx->hsbd[i].buffer,
-                                           det_ctx->hsbd[i].buffer_len,
-                                           flags);
+            cnt += HttpServerBodyPatternSearch(det_ctx,
+                    det_ctx->hsbd[i].buffer,
+                    det_ctx->hsbd[i].buffer_len,
+                    flags);
+        }
     }
 
     return cnt;
@@ -268,24 +272,26 @@ int DetectEngineInspectHttpServerBody(DetectEngineCtx *de_ctx,
     DetectEngineBufferHttpServerBodies(de_ctx, det_ctx, f, alstate);
     FLOWLOCK_UNLOCK(f);
 
-    for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
-        uint8_t *hsbd_buffer = det_ctx->hsbd[i].buffer;
-        uint32_t hsbd_buffer_len = det_ctx->hsbd[i].buffer_len;
-
-        if (hsbd_buffer == NULL || hsbd_buffer_len == 0)
-            continue;
-
-        det_ctx->buffer_offset = 0;
-        det_ctx->discontinue_matching = 0;
-        det_ctx->inspection_recursion_counter = 0;
-
-        r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HSBDMATCH],
-                                          f,
-                                          hsbd_buffer,
-                                          hsbd_buffer_len,
-                                          DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSBD, NULL);
-        if (r == 1) {
-            break;
+    if (det_ctx->hsbd != NULL && det_ctx->hsbd_buffers_list_len) {
+        for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
+            uint8_t *hsbd_buffer = det_ctx->hsbd[i].buffer;
+            uint32_t hsbd_buffer_len = det_ctx->hsbd[i].buffer_len;
+
+            if (hsbd_buffer == NULL || hsbd_buffer_len == 0)
+                continue;
+
+            det_ctx->buffer_offset = 0;
+            det_ctx->discontinue_matching = 0;
+            det_ctx->inspection_recursion_counter = 0;
+
+            r = DetectEngineContentInspection(de_ctx, det_ctx, s, s->sm_lists[DETECT_SM_LIST_HSBDMATCH],
+                    f,
+                    hsbd_buffer,
+                    hsbd_buffer_len,
+                    DETECT_ENGINE_CONTENT_INSPECTION_MODE_HSBD, NULL);
+            if (r == 1) {
+                break;
+            }
         }
     }
 
@@ -300,8 +306,10 @@ int DetectEngineInspectHttpServerBody(DetectEngineCtx *de_ctx,
 void DetectEngineCleanHSBDBuffers(DetectEngineThreadCtx *det_ctx)
 {
     int i;
-    for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
-        det_ctx->hsbd[i].buffer_len = 0;
+    if (det_ctx->hsbd != NULL && det_ctx->hsbd_buffers_list_len) {
+        for (i = 0; i < det_ctx->hsbd_buffers_list_len; i++) {
+            det_ctx->hsbd[i].buffer_len = 0;
+        }
     }
     return;
 }