From: Victor Julien <victor@inliniac.net>
Date: Sat, 1 Dec 2018 09:06:54 +0000 (+0100)
Subject: detect/mpm: fix fast_pattern handling of len >255
X-Git-Tag: suricata-4.1.1~42
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6f2b974f9c3307062f2f274693eeaf442eddadcf;p=thirdparty%2Fsuricata.git

detect/mpm: fix fast_pattern handling of len >255

The fast pattern selection logic would truncate a patterns len to
255 leading to assigning the same pid to different patterns.

This in turn would be caught by the hyperscan setup code which would
abort.

Bug #2714.
---

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index 9a10da9f71..c7a8671810 100644
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -1505,7 +1505,7 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
         return -1;
 
     uint8_t *content = NULL;
-    uint8_t content_len = 0;
+    uint16_t content_len = 0;
     PatIntId max_id = 0;
     DetectFPAndItsId *struct_offset = (DetectFPAndItsId *)ahb;
     uint8_t *content_offset = ahb + struct_total_size;