Skip to content

Commit 75ab49c

Browse files
catenacybercatenacyber
committed
detect: allocate arrays on the heap
buffer_type_id is a u32 Ticket: 8001
1 parent 81a8102 commit 75ab49c

File tree

3 files changed

+68
-34
lines changed

3 files changed

+68
-34
lines changed

‎src/detect-engine-analyzer.c‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1560,8 +1560,14 @@ void DumpPatterns(DetectEngineCtx *de_ctx)
15601560
return;
15611561

15621562
SCJsonBuilder *root_jb = SCJbNewObject();
1563-
SCJsonBuilder *arrays[de_ctx->buffer_type_id];
1564-
memset(&arrays, 0, sizeof(SCJsonBuilder *) * de_ctx->buffer_type_id);
1563+
if (root_jb == NULL) {
1564+
return;
1565+
}
1566+
SCJsonBuilder **arrays = SCCalloc(sizeof(SCJsonBuilder *), de_ctx->buffer_type_id);
1567+
if (arrays == NULL) {
1568+
SCJbFree(root_jb);
1569+
return;
1570+
}
15651571

15661572
SCJbOpenArray(root_jb, "buffers");
15671573

@@ -1629,6 +1635,7 @@ void DumpPatterns(DetectEngineCtx *de_ctx)
16291635
}
16301636
SCMutexUnlock(&g_rules_analyzer_write_m);
16311637
SCJbFree(root_jb);
1638+
SCFree(arrays);
16321639

16331640
HashListTableFree(de_ctx->pattern_hash_table);
16341641
de_ctx->pattern_hash_table = NULL;

‎src/detect-engine-build.c‎

Lines changed: 28 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -602,6 +602,13 @@ static bool RuleMpmIsNegated(const Signature *s)
602602
return (cd->flags & DETECT_CONTENT_NEGATED) ? true : false;
603603
}
604604

605+
typedef struct MpmStat {
606+
uint32_t total;
607+
uint32_t cnt;
608+
uint32_t min;
609+
uint32_t max;
610+
} MpmStat;
611+
605612
static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
606613
const SigGroupHead *sgh, const int add_rules, const int add_mpm_stats)
607614
{
@@ -620,13 +627,12 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
620627

621628
int max_buffer_type_id = de_ctx->buffer_type_id;
622629

623-
struct {
624-
uint32_t total;
625-
uint32_t cnt;
626-
uint32_t min;
627-
uint32_t max;
628-
} mpm_stats[max_buffer_type_id];
629-
memset(mpm_stats, 0x00, sizeof(mpm_stats));
630+
MpmStat *mpm_stats = NULL;
631+
if (add_mpm_stats) {
632+
mpm_stats = SCCalloc(max_buffer_type_id, sizeof(MpmStat));
633+
if (mpm_stats == NULL)
634+
return NULL;
635+
}
630636

631637
uint32_t alstats[g_alproto_max];
632638
memset(alstats, 0, g_alproto_max * sizeof(uint32_t));
@@ -636,12 +642,16 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
636642
memset(alproto_mpm_bufs, 0, sizeof(alproto_mpm_bufs));
637643

638644
DEBUG_VALIDATE_BUG_ON(sgh->init == NULL);
639-
if (sgh->init == NULL)
645+
if (sgh->init == NULL) {
646+
SCFree(mpm_stats);
640647
return NULL;
648+
}
641649

642650
SCJsonBuilder *js = SCJbNewObject();
643-
if (unlikely(js == NULL))
651+
if (unlikely(js == NULL)) {
652+
SCFree(mpm_stats);
644653
return NULL;
654+
}
645655

646656
SCJbSetUint(js, "id", sgh->id);
647657

@@ -732,13 +742,14 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
732742
mpms_max = w;
733743

734744
BUG_ON(mpm_list >= max_buffer_type_id);
735-
mpm_stats[mpm_list].total += w;
736-
mpm_stats[mpm_list].cnt++;
737-
if (mpm_stats[mpm_list].min == 0 || w < mpm_stats[mpm_list].min)
738-
mpm_stats[mpm_list].min = w;
739-
if (w > mpm_stats[mpm_list].max)
740-
mpm_stats[mpm_list].max = w;
741-
745+
if (mpm_stats != NULL) {
746+
mpm_stats[mpm_list].total += w;
747+
mpm_stats[mpm_list].cnt++;
748+
if (mpm_stats[mpm_list].min == 0 || w < mpm_stats[mpm_list].min)
749+
mpm_stats[mpm_list].min = w;
750+
if (w > mpm_stats[mpm_list].max)
751+
mpm_stats[mpm_list].max = w;
752+
}
742753
mpm_cnt++;
743754

744755
if (w < 10) {
@@ -863,6 +874,7 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
863874

864875
SCJbSetUint(js, "score", sgh->init->score);
865876
SCJbClose(js);
877+
SCFree(mpm_stats);
866878

867879
return js;
868880
}

‎src/detect-engine-mpm.c‎

Lines changed: 31 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1523,18 +1523,23 @@ static const DetectBufferMpmRegistry *GetByMpmStore(
15231523
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
15241524
{
15251525
HashListTableBucket *htb = NULL;
1526+
uint32_t *appstats = NULL;
1527+
uint32_t *pktstats = NULL;
1528+
uint32_t *framestats = NULL;
15261529

15271530
uint32_t stats[MPMB_MAX] = {0};
1528-
DEBUG_VALIDATE_BUG_ON(de_ctx->buffer_type_id > UINT16_MAX);
1529-
int app_mpms_cnt = de_ctx->buffer_type_id;
1530-
uint32_t appstats[app_mpms_cnt + 1]; // +1 to silence scan-build
1531-
memset(&appstats, 0x00, sizeof(appstats));
1532-
int pkt_mpms_cnt = de_ctx->buffer_type_id;
1533-
uint32_t pktstats[pkt_mpms_cnt + 1]; // +1 to silence scan-build
1534-
memset(&pktstats, 0x00, sizeof(pktstats));
1535-
int frame_mpms_cnt = de_ctx->buffer_type_id;
1536-
uint32_t framestats[frame_mpms_cnt + 1]; // +1 to silence scan-build
1537-
memset(&framestats, 0x00, sizeof(framestats));
1531+
appstats = SCCalloc(de_ctx->buffer_type_id, sizeof(uint32_t));
1532+
if (appstats == NULL) {
1533+
goto end;
1534+
}
1535+
pktstats = SCCalloc(de_ctx->buffer_type_id, sizeof(uint32_t));
1536+
if (pktstats == NULL) {
1537+
goto end;
1538+
}
1539+
framestats = SCCalloc(de_ctx->buffer_type_id, sizeof(uint32_t));
1540+
if (framestats == NULL) {
1541+
goto end;
1542+
}
15381543

15391544
for (htb = HashListTableGetListHead(de_ctx->mpm_hash_table);
15401545
htb != NULL;
@@ -1610,6 +1615,13 @@ void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
16101615
um = um->next;
16111616
}
16121617
}
1618+
end:
1619+
if (appstats)
1620+
SCFree(appstats);
1621+
if (pktstats)
1622+
SCFree(pktstats);
1623+
if (framestats)
1624+
SCFree(framestats);
16131625
}
16141626

16151627
/**
@@ -2076,12 +2088,12 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
20762088
const int max_buffer_id = de_ctx->buffer_type_id + 1;
20772089
const uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
20782090

2079-
AppProto engines[max_buffer_id][g_alproto_max];
2080-
memset(engines, 0, sizeof(engines));
2081-
int engines_idx[max_buffer_id];
2082-
memset(engines_idx, 0, sizeof(engines_idx));
2083-
int types[max_buffer_id];
2084-
memset(types, 0, sizeof(types));
2091+
AppProto(*engines)[g_alproto_max] = SCCalloc(max_buffer_id, sizeof(AppProto[g_alproto_max]));
2092+
BUG_ON(engines == NULL);
2093+
int *engines_idx = SCCalloc(max_buffer_id, sizeof(int));
2094+
BUG_ON(engines_idx == NULL);
2095+
int *types = SCCalloc(max_buffer_id, sizeof(int));
2096+
BUG_ON(types == NULL);
20852097

20862098
/* flag the list+directions we have engines for as active */
20872099
for (DetectBufferMpmRegistry *a = de_ctx->pkt_mpms_list; a != NULL; a = a->next) {
@@ -2318,6 +2330,9 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
23182330
}
23192331
}
23202332
HashListTableFree(bufs);
2333+
SCFree(engines);
2334+
SCFree(engines_idx);
2335+
SCFree(types);
23212336
}
23222337

23232338
/** \brief Prepare the pattern matcher ctx in a sig group head.

0 commit comments

Comments
 (0)