]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect: fixes use-after-free with http.request_header
authorPhilippe Antoine <pantoine@oisf.net>
Tue, 7 Nov 2023 09:33:21 +0000 (10:33 +0100)
committerVictor Julien <vjulien@oisf.net>
Tue, 6 Feb 2024 14:16:43 +0000 (15:16 +0100)
commitbc422c17d6961f03f673f2999a949913e89fc2d0
tree6fd92b323a80ca8d2317a210918efeedd2048859
parent61f2e4e1e5b34dfd8ae44d1c15253e2da65f6e6a
detect: fixes use-after-free with http.request_header

Ticket: #6441

This keyword and the response one use a multiple inspection buffer.
But the different instances point to the same memory address
that comes from HttpHeaderGetBufferSpace and is not owned
by the transaction, and is rebuilt, which is a functional
bug in itself.

As it gets crafted, it can get reallocated if one header
is over 1024 bytes, while the previous freed pointer will still get
used for the previous headers.
src/detect-http-header.c