Pull request #3693: js_norm: update PDF tokenizer to use glue input streambuf

Merge in SNORT/snort3 from ~OSERHIIE/snort3:js_pdf_fixup to master

Squashed commit of the following:

commit a1ea7641078ab9622838882605cfd2ffbf012e84
Author: Oleksandr Serhiienko <oserhiie@cisco.com>
Date:   Mon Dec 5 15:08:20 2022 +0100

    js_norm: fix pdf_tokenizer_test on FreeBSD platform

commit af4be627c44f45dcae8fc24fe085ff4c03d972bf
Author: Oleksandr Serhiienko <oserhiie@cisco.com>
Date:   Mon Dec 5 15:05:54 2022 +0100

    js_norm: update PDF tokenizer to use glue input streambuf

        * js_norm: update PDF tokenizer EOF rule to cover all starting conditions
        * http_inspect: update PDF JSNorm to use istreambuf_glue

diff --git a/src/js_norm/pdf_tokenizer.l b/src/js_norm/pdf_tokenizer.l
index 181c2195914d22b5f796979f7ecb9899f1942182..20d497ee61f87fce360a15e2bfe5260e10bfac42 100644 (file)
--- a/src/js_norm/pdf_tokenizer.l
+++ b/src/js_norm/pdf_tokenizer.l
@@ -189,7 +189,7 @@ WHITESPACE        {GRP_WHITESPACE}{1,64}
 <jshstr>{HEX_STR_BODY}                            { EXEC(h_hex_hex2chr()) }
 <jshstr>{HEX_STR_SKIP}                            { }
 
-<<EOF>>                                           { return PDFRet::EOS; }
+<INITIAL,dictnr,litstr,hexstr,jslstr,jshstr><<EOF>>    { return PDFRet::EOS; }
 
 %%
 

diff --git a/src/js_norm/test/pdf_tokenizer_test.cc b/src/js_norm/test/pdf_tokenizer_test.cc
index b2986538ba11d8b6e81d61ffb86155406bd1f0cc..13eb326cac2cc7a4374ba1257e616dec0bbede58 100644 (file)
--- a/src/js_norm/test/pdf_tokenizer_test.cc
+++ b/src/js_norm/test/pdf_tokenizer_test.cc
@@ -58,7 +58,7 @@ static void test_pdf_proc(const vector<Chunk>& chunks)
         auto src = chunk.first;
         auto exp = chunk.second;
 
-        in.rdbuf()->pubsetbuf((char*)src.c_str(), src.length());
+        in.str(src);
         out.str("");
 
         auto r = extractor.process();

diff --git a/src/service_inspectors/http_inspect/http_js_norm.cc b/src/service_inspectors/http_inspect/http_js_norm.cc
index bacc34a681b155215d4ae8f11e2efb7e08f0cc10..1936047ebf3ad2321e0e63f0368a6620ccf01919 100644 (file)
--- a/src/service_inspectors/http_inspect/http_js_norm.cc
+++ b/src/service_inspectors/http_inspect/http_js_norm.cc
@@ -453,7 +453,9 @@ bool HttpPDFJSNorm::pre_proc()
     }
 
     // an input stream should not write to its buffer
-    pdf_in.rdbuf()->pubsetbuf(const_cast<char*>((const char*)src_ptr), src_end - src_ptr);
+    buf_pdf_in.pubsetbuf(nullptr, 0)
+        ->pubsetbuf(const_cast<char*>((const char*)src_ptr), src_end - src_ptr);
+
     pdf_out.clear();
     delete[] buf_pdf_out.take_data();
 

diff --git a/src/service_inspectors/http_inspect/http_js_norm.h b/src/service_inspectors/http_inspect/http_js_norm.h
index 1b750f0e17d40a7505413896493ed242ff3c4a3d..ff6945e4719dd4b0d8106e55bb7ea89dfa482e40 100644 (file)
--- a/src/service_inspectors/http_inspect/http_js_norm.h
+++ b/src/service_inspectors/http_inspect/http_js_norm.h
@@ -102,7 +102,7 @@ public:
     }
 
     HttpPDFJSNorm(JSNormConfig* jsn_config, uint64_t tid) :
-        HttpJSNorm(jsn_config), pdf_out(&buf_pdf_out), extractor(pdf_in, pdf_out)
+        HttpJSNorm(jsn_config), pdf_in(&buf_pdf_in), pdf_out(&buf_pdf_out), extractor(pdf_in, pdf_out)
     { trans_num = tid; }
 
 protected:
@@ -110,8 +110,9 @@ protected:
     bool post_proc(int) override;
 
 private:
+    snort::istreambuf_glue buf_pdf_in;
     snort::ostreambuf_infl buf_pdf_out;
-    std::istringstream pdf_in;
+    std::istream pdf_in;
     std::ostream pdf_out;
     jsn::PDFTokenizer extractor;
 };