detect: fix out of bounds write in detect thread space creation

diff --git a/src/detect-engine-filedata.c b/src/detect-engine-filedata.c
index f9b7f55f3970d1de041716b84e10decb054fb61f..bf751e16cd0eb0b3f58d5b6da949e0bd014804d8 100644 (file)
--- a/src/detect-engine-filedata.c
+++ b/src/detect-engine-filedata.c
@@ -40,10 +40,12 @@
 
 static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t size)
 {
-    void *ptmp;
     if (size > det_ctx->file_data_buffers_size) {
-        ptmp = SCRealloc(det_ctx->file_data,
-                         (det_ctx->file_data_buffers_size + BUFFER_STEP) * sizeof(FiledataReassembledBody));
+        uint16_t grow_by = size - det_ctx->file_data_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
+        void *ptmp = SCRealloc(det_ctx->file_data,
+                         (det_ctx->file_data_buffers_size + grow_by) * sizeof(FiledataReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->file_data);
             det_ctx->file_data = NULL;
@@ -53,10 +55,13 @@ static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t s
         }
         det_ctx->file_data = ptmp;
 
-        memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, BUFFER_STEP * sizeof(FiledataReassembledBody));
-        det_ctx->file_data_buffers_size += BUFFER_STEP;
+        memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, grow_by * sizeof(FiledataReassembledBody));
+        det_ctx->file_data_buffers_size += grow_by;
     }
-    for (int i = det_ctx->file_data_buffers_list_len; i < (size); i++) {
+    uint16_t i;
+    for (i = det_ctx->file_data_buffers_list_len;
+            i < det_ctx->file_data_buffers_size; i++)
+    {
         det_ctx->file_data[i].buffer_len = 0;
         det_ctx->file_data[i].offset = 0;
     }

diff --git a/src/detect-engine-hcbd.c b/src/detect-engine-hcbd.c
index 6d511b629a1b86d1ce2dd8fd86ec863fc37cb6cd..df27e9e7e8eb799c3e0078da19ca5c52480b5509 100644 (file)
--- a/src/detect-engine-hcbd.c
+++ b/src/detect-engine-hcbd.c
@@ -74,8 +74,11 @@ static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
 
     void *ptmp;
     if (size > det_ctx->hcbd_buffers_size) {
+        uint16_t grow_by = size - det_ctx->hcbd_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
         ptmp = SCRealloc(det_ctx->hcbd,
-                         (det_ctx->hcbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody));
+                         (det_ctx->hcbd_buffers_size + grow_by) * sizeof(HttpReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->hcbd);
             det_ctx->hcbd = NULL;
@@ -85,11 +88,11 @@ static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
         }
         det_ctx->hcbd = ptmp;
 
-        memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody));
-        det_ctx->hcbd_buffers_size += BUFFER_STEP;
+        memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, grow_by * sizeof(HttpReassembledBody));
+        det_ctx->hcbd_buffers_size += grow_by;
 
         uint16_t i;
-        for (i = det_ctx->hcbd_buffers_list_len; i < ((uint16_t)size); i++) {
+        for (i = det_ctx->hcbd_buffers_list_len; i < det_ctx->hcbd_buffers_size; i++) {
             det_ctx->hcbd[i].buffer_len = 0;
             det_ctx->hcbd[i].offset = 0;
         }

diff --git a/src/detect-engine-hsbd.c b/src/detect-engine-hsbd.c
index f64f761c2977c8d153af537e9fa7538d7babe243..8476689824e1d3ba0838020b1f4bfe2e5129fd22 100644 (file)
--- a/src/detect-engine-hsbd.c
+++ b/src/detect-engine-hsbd.c
@@ -76,8 +76,11 @@ static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
 
     void *ptmp;
     if (size > det_ctx->hsbd_buffers_size) {
+        uint16_t grow_by = size - det_ctx->hsbd_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
         ptmp = SCRealloc(det_ctx->hsbd,
-                         (det_ctx->hsbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody));
+                         (det_ctx->hsbd_buffers_size + grow_by) * sizeof(HttpReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->hsbd);
             det_ctx->hsbd = NULL;
@@ -87,11 +90,11 @@ static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
         }
         det_ctx->hsbd = ptmp;
 
-        memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody));
-        det_ctx->hsbd_buffers_size += BUFFER_STEP;
+        memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, grow_by * sizeof(HttpReassembledBody));
+        det_ctx->hsbd_buffers_size += grow_by;
     }
     uint16_t i;
-    for (i = det_ctx->hsbd_buffers_list_len; i < ((uint16_t)size); i++) {
+    for (i = det_ctx->hsbd_buffers_list_len; i < det_ctx->hsbd_buffers_size; i++) {
         det_ctx->hsbd[i].buffer_len = 0;
         det_ctx->hsbd[i].offset = 0;
         det_ctx->hsbd[i].decompressed_buffer_len = 0;