From: Victor Julien <victor@inliniac.net>
Date: Tue, 31 Mar 2020 12:04:07 +0000 (+0200)
Subject: detect/parse: fix crash on 'internal' keyword use
X-Git-Tag: suricata-6.0.0-beta1~575
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=095981cb2a7b204e66770ab5ab4efcf5034caa27;p=thirdparty%2Fsuricata.git

detect/parse: fix crash on 'internal' keyword use

When keyword __flowvar__postmatch__, an internal keyword, is used
in a rule the 'Setup' func ptr will be NULL. This caused a crash.
---

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 4663afefbe..7224bc7ddb 100644
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -694,7 +694,7 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
 
     /* Call option parsing */
     st = SigTableGet(optname);
-    if (st == NULL) {
+    if (st == NULL || st->Setup == NULL) {
         SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "unknown rule keyword '%s'.", optname);
         goto error;
     }