signature: checks for integer overflow in limits propagation

(cherry picked from commit a99ad4c1e4251c8a4a667d613ccb1fb334a9b268)

diff --git a/src/detect-content.c b/src/detect-content.c
index 2217943d7f62b030620877c7121710f8caf902eb..3e584e7caee1f02019096aef917e3b0008b118ad 100644 (file)
--- a/src/detect-content.c
+++ b/src/detect-content.c
@@ -495,7 +495,11 @@ void DetectContentPropagateLimits(Signature *s)
                     SCLogDebug("stored: offset %u depth %u offset_plus_pat %u", offset, depth, offset_plus_pat);
 
                     if (cd->flags & DETECT_CONTENT_DISTANCE && cd->distance >= 0) {
-                        offset = cd->offset = offset_plus_pat + cd->distance;
+                        if ((uint32_t)offset_plus_pat + cd->distance <= UINT16_MAX) {
+                            offset = cd->offset = offset_plus_pat + cd->distance;
+                        } else {
+                            SCLogDebug("not updated content offset as it would overflow : %u + %d", offset_plus_pat, cd->distance);
+                        }
                         SCLogDebug("updated content to have offset %u", cd->offset);
                     }
                     if (have_anchor && !last_reset && offset_plus_pat && cd->flags & DETECT_CONTENT_WITHIN && cd->within >= 0) {