detect: impose limits on pcrexform

Impose match and recursion limits on pcrexform keywords.

Based on: 585e5e0d3c4e ("detect: impose limits on pcrexform")

Bug: #5414.

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 5644b55231f0c5a8627b58f88928e0fb30d070aa..e54e75a7b8e985a04d9b4a8649be2d541e4723cb 100644 (file)
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -65,9 +65,6 @@
 #define PARSE_CAPTURE_REGEX "\\(\\?P\\<([A-z]+)\\_([A-z0-9_]+)\\>"
 #define PARSE_REGEX         "(?<!\\\\)/(.*(?<!(?<!\\\\)\\\\))/([^\"]*)"
 
-#define SC_MATCH_LIMIT_DEFAULT 3500
-#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
-
 static int pcre_match_limit = 0;
 static int pcre_match_limit_recursion = 0;
 

diff --git a/src/detect-pcre.h b/src/detect-pcre.h
index ca1a519a8d92d01450890b5d4ccaa204dc51001f..45e00b9cbd2f217de0176abca1323b6931950085 100644 (file)
--- a/src/detect-pcre.h
+++ b/src/detect-pcre.h
@@ -36,6 +36,9 @@
 
 #define DETECT_PCRE_CAPTURE_MAX         8
 
+#define SC_MATCH_LIMIT_DEFAULT           3500
+#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
+
 typedef struct DetectPcreData_ {
     /* pcre options */
     DetectParseRegex parse_regex;

diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
index 54da1b5412b068830bf3b66fc49a23f7c37353fb..bf622721a8ced56913048bed91c415813ee25802 100644 (file)
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
+#include "detect-pcre.h"
 #include "detect-transform-pcrexform.h"
 
 typedef DetectParseRegex DetectTransformPcrexformData;
@@ -89,6 +90,15 @@ static int DetectTransformPcrexformSetup (DetectEngineCtx *de_ctx, Signature *s,
         SCReturnInt(-1);
     }
 
+    if (pxd->study != NULL) {
+        pxd->study->match_limit = SC_MATCH_LIMIT_DEFAULT;
+        pxd->study->flags |= PCRE_EXTRA_MATCH_LIMIT;
+#ifndef NO_PCRE_MATCH_RLIMIT
+        pxd->study->match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT;
+        pxd->study->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
+#endif
+    }
+
     int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_PCREXFORM, pxd);
     if (r != 0) {
         SCFree(pxd);