From: Philippe Antoine Date: Thu, 23 Jul 2020 09:26:16 +0000 (+0200) Subject: signature: checks for integer overflow in limits propagation X-Git-Tag: suricata-6.0.0-beta1~56 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=61c327dd80f02484481cbea6d48168063ae90a69;p=thirdparty%2Fsuricata.git signature: checks for integer overflow in limits propagation --- diff --git a/src/detect-content.c b/src/detect-content.c index baa63053db..664257801b 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -553,7 +553,11 @@ void DetectContentPropagateLimits(Signature *s) (cd->flags & (DETECT_CONTENT_DEPTH|DETECT_CONTENT_OFFSET|DETECT_CONTENT_WITHIN|DETECT_CONTENT_DISTANCE)) == (DETECT_CONTENT_DISTANCE)) { if (cd->distance >= 0) { // only distance - offset = cd->offset = offset_plus_pat + cd->distance; + if ((uint32_t)offset_plus_pat + cd->distance <= UINT16_MAX) { + offset = cd->offset = offset_plus_pat + cd->distance; + } else { + SCLogDebug("not updated content offset as it would overflow : %u + %d", offset_plus_pat, cd->distance); + } offset_plus_pat = offset + cd->content_len; SCLogDebug("offset %u offset_plus_pat %u", offset, offset_plus_pat); } @@ -718,6 +722,8 @@ static int DetectContentDepthTest01(void) // hi end: depth '13' (4+9) + distance 55 = 68 + within 2 = 70 TEST_RUN("content:\"=\"; offset:4; depth:9; content:\"=&\"; distance:55; within:2;", 60, 70); + TEST_RUN("content:\"0123456789\"; content:\"abcdef\"; distance:2147483647;", 10, 0); + TEST_DONE; }