]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
dnp3: fixes use after realloc/free in output
authorPhilippe Antoine <contact@catenacyber.fr>
Tue, 9 Mar 2021 14:22:47 +0000 (15:22 +0100)
committerVictor Julien <victor@inliniac.net>
Thu, 24 Jun 2021 11:52:13 +0000 (13:52 +0200)
OutputJsonBuilderBuffer can realloc the buffer
So, we need to give it the right reference

src/output-json-dnp3.c

index 9292b1387e5f0a8e88f52eff47bbec40b451b9a5..7b2a7192e4e87d8d688816319048c54e2a4a4117 100644 (file)
@@ -218,9 +218,7 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
     LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
     DNP3Transaction *tx = vtx;
 
-    MemBuffer *buffer = (MemBuffer *)thread->buffer;
-
-    MemBufferReset(buffer);
+    MemBufferReset(thread->buffer);
     if (tx->has_request && tx->request_done) {
         JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL);
         if (unlikely(js == NULL)) {
@@ -232,7 +230,7 @@ static int JsonDNP3LoggerToServer(ThreadVars *tv, void *thread_data,
         jb_open_object(js, "dnp3");
         JsonDNP3LogRequest(js, tx);
         jb_close(js);
-        OutputJsonBuilderBuffer(js, thread->file_ctx, &buffer);
+        OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer);
         jb_free(js);
     }
 
@@ -246,9 +244,7 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
     LogDNP3LogThread *thread = (LogDNP3LogThread *)thread_data;
     DNP3Transaction *tx = vtx;
 
-    MemBuffer *buffer = (MemBuffer *)thread->buffer;
-
-    MemBufferReset(buffer);
+    MemBufferReset(thread->buffer);
     if (tx->has_response && tx->response_done) {
         JsonBuilder *js = CreateEveHeader(p, LOG_DIR_FLOW, "dnp3", NULL);
         if (unlikely(js == NULL)) {
@@ -259,7 +255,7 @@ static int JsonDNP3LoggerToClient(ThreadVars *tv, void *thread_data,
         jb_open_object(js, "dnp3");
         JsonDNP3LogResponse(js, tx);
         jb_close(js);
-        OutputJsonBuilderBuffer(js, thread->file_ctx, &buffer);
+        OutputJsonBuilderBuffer(js, thread->file_ctx, &thread->buffer);
         jb_free(js);
     }