]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect/pcre: avoid infinite loop after negated pcre
authorPhilippe Antoine <pantoine@oisf.net>
Tue, 28 Jan 2025 14:02:45 +0000 (15:02 +0100)
committerVictor Julien <vjulien@oisf.net>
Mon, 17 Mar 2025 19:56:43 +0000 (20:56 +0100)
commitf6c9490e1f7b0b375c286d5313ebf3bc81a95eb6
treec92d2ad4810fe0a39007cfacb4a2d2c20d083bde
parentb81392dde55220c50dc4c834fdf71fb3d92accb8
detect/pcre: avoid infinite loop after negated pcre

Ticket: 7526

The usage of negated pcre, followed by other relative payload
content keywords could lead to an infinite loop.

This is because regular (not negated) pcre can test multiple
occurences, but negated pcre should be tried only once.

(cherry picked from commit b14c67cbdf25fa6c7ffe0d04ddf3ebe67b12b50b)
src/detect-engine-content-inspection.c