From 095981cb2a7b204e66770ab5ab4efcf5034caa27 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 31 Mar 2020 14:04:07 +0200 Subject: [PATCH] detect/parse: fix crash on 'internal' keyword use When keyword __flowvar__postmatch__, an internal keyword, is used in a rule the 'Setup' func ptr will be NULL. This caused a crash. --- src/detect-parse.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-parse.c b/src/detect-parse.c index 4663afefbe..7224bc7ddb 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -694,7 +694,7 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr, /* Call option parsing */ st = SigTableGet(optname); - if (st == NULL) { + if (st == NULL || st->Setup == NULL) { SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "unknown rule keyword '%s'.", optname); goto error; } -- 2.47.2