From: Pierre Chifflier <chifflier@wzdftpd.net>
Date: Fri, 14 Mar 2014 17:59:11 +0000 (+0100)
Subject: Hash table: check hash array size when inserting element
X-Git-Tag: suricata-4.1.0-beta1~446
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bf166420fa5b7ecb56b82edeee19a1614a5922ae;p=thirdparty%2Fsuricata.git

Hash table: check hash array size when inserting element

If the hash function returns an index greater than the array size of the
hash table, the index is not checked. Even if this is the responsibility
of the caller, add a safety check to avoid errors.
---

diff --git a/src/util-hash.c b/src/util-hash.c
index ae72cd8a9f..b9c9986f94 100644
--- a/src/util-hash.c
+++ b/src/util-hash.c
@@ -125,6 +125,11 @@ int HashTableAdd(HashTable *ht, void *data, uint16_t datalen)
     hb->size = datalen;
     hb->next = NULL;
 
+    if (hash >= ht->array_size) {
+        SCLogWarning(SC_ERR_INVALID_VALUE, "attempt to insert element out of hash array\n");
+        goto error;
+    }
+
     if (ht->array[hash] == NULL) {
         ht->array[hash] = hb;
     } else {
@@ -192,6 +197,11 @@ void *HashTableLookup(HashTable *ht, void *data, uint16_t datalen)
 
     hash = ht->Hash(ht, data, datalen);
 
+    if (hash >= ht->array_size) {
+        SCLogWarning(SC_ERR_INVALID_VALUE, "attempt to access element out of hash array\n");
+        return NULL;
+    }
+
     if (ht->array[hash] == NULL)
         return NULL;