From 6c2cdbb5f0c8af6d88fb0ffc1653d25896471073 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Sat, 4 Jan 2020 09:12:38 -0500 Subject: [PATCH] analysis: exit if table entries are stale This commit causes Suricata to exit when a buffer from the analyzer table is not recognized. Since the table must match what's registered, exiting will bring noticed to the condition. --- src/detect-engine-analyzer.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 1f7acc92b7..1e1b510a7c 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -963,6 +963,12 @@ static void EngineAnalysisItemsInit(void) DetectEngineAnalyzerItems *analyzer_item = &analyzer_items[i]; analyzer_item->item_id = DetectBufferTypeGetByName(analyzer_item->item_name); + if (analyzer_item->item_id == -1) { + /* Mismatch between the analyzer_items array and what's supported */ + FatalError(SC_ERR_INITIALIZATION, + "unable to initialize engine-analysis table: detect buffer \"%s\" not recognized.", + analyzer_item->item_name); + } analyzer_item->item_seen = false; if (analyzer_item->export_item_seen) { -- 2.47.2