detect: fix integer warnings for app-layer-event

Ticket: #4516

diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index 81202e2e29041c50c1860a5bc7f8c6cc79f5effd..174e25827ba57c6a5fe75f0676c9d1fa34c3cb43 100644 (file)
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -145,7 +145,7 @@ static DetectAppLayerEventData *DetectAppLayerEventParsePkt(const char *arg,
 {
     int event_id = 0;
     int r = AppLayerGetPktEventInfo(arg, &event_id);
-    if (r < 0) {
+    if (r < 0 || r > UINT8_MAX) {
         SCLogError(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword "
                    "supplied with packet based event - \"%s\" that isn't "
                    "supported yet.", arg);
@@ -155,7 +155,7 @@ static DetectAppLayerEventData *DetectAppLayerEventParsePkt(const char *arg,
     DetectAppLayerEventData *aled = SCCalloc(1, sizeof(DetectAppLayerEventData));
     if (unlikely(aled == NULL))
         return NULL;
-    aled->event_id = event_id;
+    aled->event_id = (uint8_t)event_id;
     *event_type = APP_LAYER_EVENT_TYPE_PACKET;
 
     return aled;
@@ -231,7 +231,11 @@ static int DetectAppLayerEventParseAppP2(DetectAppLayerEventData *data,
             return -3;
         }
     }
-    data->event_id = event_id;
+    if (event_id > UINT8_MAX) {
+        SCLogWarning(SC_ERR_INVALID_SIGNATURE, "app-layer-event keyword's id has invalid value");
+        return -4;
+    }
+    data->event_id = (uint8_t)event_id;
 
     return 0;
 }

diff --git a/src/detect-app-layer-event.h b/src/detect-app-layer-event.h
index 0f36f99d83ba270fdb08ef49179e93fc87dbfff1..8db6eaa7efda3d5ad4db37928f93ccddc8d768e8 100644 (file)
--- a/src/detect-app-layer-event.h
+++ b/src/detect-app-layer-event.h
@@ -26,7 +26,7 @@
 
 typedef struct DetectAppLayerEventData_ {
     AppProto alproto;
-    int event_id;
+    uint8_t event_id;
 
     /* it's used to check if there are event set into the detect engine */
     bool needs_detctx;