From: Victor Julien <vjulien@oisf.net>
Date: Thu, 30 Jun 2022 14:52:44 +0000 (+0200)
Subject: detect: impose limits on pcrexform
X-Git-Tag: suricata-6.0.6~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F7596%2Fhead;p=thirdparty%2Fsuricata.git

detect: impose limits on pcrexform

Impose match and recursion limits on pcrexform keywords.

Based on: 585e5e0d3c4e ("detect: impose limits on pcrexform")

Bug: #5414.
---

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 5644b55231..e54e75a7b8 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -65,9 +65,6 @@
 #define PARSE_CAPTURE_REGEX "\\(\\?P\\<([A-z]+)\\_([A-z0-9_]+)\\>"
 #define PARSE_REGEX         "(?<!\\\\)/(.*(?<!(?<!\\\\)\\\\))/([^\"]*)"
 
-#define SC_MATCH_LIMIT_DEFAULT 3500
-#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
-
 static int pcre_match_limit = 0;
 static int pcre_match_limit_recursion = 0;
 
diff --git a/src/detect-pcre.h b/src/detect-pcre.h
index ca1a519a8d..45e00b9cbd 100644
--- a/src/detect-pcre.h
+++ b/src/detect-pcre.h
@@ -36,6 +36,9 @@
 
 #define DETECT_PCRE_CAPTURE_MAX         8
 
+#define SC_MATCH_LIMIT_DEFAULT           3500
+#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
+
 typedef struct DetectPcreData_ {
     /* pcre options */
     DetectParseRegex parse_regex;
diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
index 54da1b5412..bf622721a8 100644
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@@ -28,6 +28,7 @@
 #include "detect.h"
 #include "detect-engine.h"
 #include "detect-parse.h"
+#include "detect-pcre.h"
 #include "detect-transform-pcrexform.h"
 
 typedef DetectParseRegex DetectTransformPcrexformData;
@@ -89,6 +90,15 @@ static int DetectTransformPcrexformSetup (DetectEngineCtx *de_ctx, Signature *s,
         SCReturnInt(-1);
     }
 
+    if (pxd->study != NULL) {
+        pxd->study->match_limit = SC_MATCH_LIMIT_DEFAULT;
+        pxd->study->flags |= PCRE_EXTRA_MATCH_LIMIT;
+#ifndef NO_PCRE_MATCH_RLIMIT
+        pxd->study->match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT;
+        pxd->study->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
+#endif
+    }
+
     int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_PCREXFORM, pxd);
     if (r != 0) {
         SCFree(pxd);