detect/parse: set limits for pcre2

Ticket: 6889

To avoid regexp dos with too much backtracking.
This is already done on pcre keyword, and pcrexform transform.
We use the same default limits for rules parsing.

(cherry picked from commit 316cc528f784c86339d05907a4d6084cbe4d44e6)

Using pcre1 in master6

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 020917e663b3691ead2e1d41eed424826092524e..bc581b5f54f8d7a8f1f6a254875fb96676460940 100644 (file)
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -2497,7 +2497,14 @@ bool DetectSetupParseRegexesOpts(const char *parse_str, DetectParseRegex *detect
         SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
         return false;
     }
-
+    if (detect_parse->study != NULL) {
+        detect_parse->study->match_limit = SC_MATCH_LIMIT_DEFAULT;
+        detect_parse->study->flags |= PCRE_EXTRA_MATCH_LIMIT;
+#ifndef NO_PCRE_MATCH_RLIMIT
+        detect_parse->study->match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT;
+        detect_parse->study->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
+#endif /* NO_PCRE_MATCH_RLIMIT */
+    }
 
     DetectParseRegexAddToFreeList(detect_parse);