From: Philippe Antoine <contact@catenacyber.fr>
Date: Fri, 3 Jun 2022 13:42:27 +0000 (+0200)
Subject: detect: fix integer warnings for app-layer-event
X-Git-Tag: suricata-7.0.0-beta1~469
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=57fb183d32b518137eb089366a8fd80f6b5162ca;p=thirdparty%2Fsuricata.git

detect: fix integer warnings for app-layer-event

Ticket: #4516
---

diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index 81202e2e29..174e25827b 100644
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -145,7 +145,7 @@ static DetectAppLayerEventData *DetectAppLayerEventParsePkt(const char *arg,
 {
     int event_id = 0;
     int r = AppLayerGetPktEventInfo(arg, &event_id);
-    if (r < 0) {
+    if (r < 0 || r > UINT8_MAX) {
         SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword "
                    "supplied with packet based event - \"%s\" that isn't "
                    "supported yet.", arg);
@@ -155,7 +155,7 @@ static DetectAppLayerEventData *DetectAppLayerEventParsePkt(const char *arg,
     DetectAppLayerEventData *aled = SCCalloc(1, sizeof(DetectAppLayerEventData));
     if (unlikely(aled == NULL))
         return NULL;
-    aled->event_id = event_id;
+    aled->event_id = (uint8_t)event_id;
     *event_type = APP_LAYER_EVENT_TYPE_PACKET;
 
     return aled;
@@ -231,7 +231,11 @@ static int DetectAppLayerEventParseAppP2(DetectAppLayerEventData *data,
             return -3;
         }
     }
-    data->event_id = event_id;
+    if (event_id > UINT8_MAX) {
+        SCLogWarning(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword's id has invalid value");
+        return -4;
+    }
+    data->event_id = (uint8_t)event_id;
 
     return 0;
 }
diff --git a/src/detect-app-layer-event.h b/src/detect-app-layer-event.h
index 0f36f99d83..8db6eaa7ef 100644
--- a/src/detect-app-layer-event.h
+++ b/src/detect-app-layer-event.h
@@ -26,7 +26,7 @@
 
 typedef struct DetectAppLayerEventData_ {
     AppProto alproto;
-    int event_id;
+    uint8_t event_id;
 
     /* it's used to check if there are event set into the detect engine */
     bool needs_detctx;