From b14c67cbdf25fa6c7ffe0d04ddf3ebe67b12b50b Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 28 Jan 2025 15:02:45 +0100 Subject: [PATCH] detect/pcre: avoid infinite loop after negated pcre Ticket: 7526 The usage of negated pcre, followed by other relative payload content keywords could lead to an infinite loop. This is because regular (not negated) pcre can test multiple occurences, but negated pcre should be tried only once. --- src/detect-engine-content-inspection.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c index dbc18c2980..6ccc5e533e 100644 --- a/src/detect-engine-content-inspection.c +++ b/src/detect-engine-content-inspection.c @@ -457,7 +457,6 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx, if (r == 0) { goto no_match; } - if (!(pe->flags & DETECT_PCRE_RELATIVE_NEXT)) { SCLogDebug("no relative match coming up, so this is a match"); goto match; @@ -478,6 +477,11 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx, SCReturnInt(-1); } + if (prev_offset == 0) { + // This happens for negated PCRE + // We do not search for another occurrence of this pcre + SCReturnInt(0); + } det_ctx->buffer_offset = prev_buffer_offset; det_ctx->pcre_match_start_offset = prev_offset; } while (1); -- 2.47.2