From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 28 Jan 2025 14:02:45 +0000 (+0100)
Subject: detect/pcre: avoid infinite loop after negated pcre
X-Git-Tag: suricata-7.0.9~17
X-Git-Url: http://git.ipfire.org/gitweb/gitweb.cgi?a=commitdiff_plain;h=f6c9490e1f7b0b375c286d5313ebf3bc81a95eb6;p=thirdparty%2Fsuricata.git

detect/pcre: avoid infinite loop after negated pcre

Ticket: 7526

The usage of negated pcre, followed by other relative payload
content keywords could lead to an infinite loop.

This is because regular (not negated) pcre can test multiple
occurences, but negated pcre should be tried only once.

(cherry picked from commit b14c67cbdf25fa6c7ffe0d04ddf3ebe67b12b50b)
---

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index 06b18283fb..3ca221235c 100644
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -450,7 +450,6 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
             if (r == 0) {
                 goto no_match;
             }
-
             if (!(pe->flags & DETECT_PCRE_RELATIVE_NEXT)) {
                 SCLogDebug("no relative match coming up, so this is a match");
                 goto match;
@@ -473,6 +472,11 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
             if (det_ctx->discontinue_matching)
                 goto no_match;
 
+            if (prev_offset == 0) {
+                // This happens for negated PCRE
+                // We do not search for another occurrence of this pcre
+                SCReturnInt(0);
+            }
             det_ctx->buffer_offset = prev_buffer_offset;
             det_ctx->pcre_match_start_offset = prev_offset;
         } while (1);