Skip to content

Conversation

@catenacyber
Copy link
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/8001

Describe changes: improve stack allocations

  • allocate on the heap if it can be large
  • adds safety checks or debug validation

#14659 with unit tests fix

Still todo after : handle other cases of git grep '\];' src/*.c | grep -v = | grep -v '[0-9]\];' | grep -v '[A-Z]\];' | grep -v return | grep -v g_alproto_max | grep -v '\[\];' | grep -v sizeof after src/detect-engine.c

Even if current caller does not provide too big data.

Ticket: 8001
To be able to load 1M signatures and not have a stack overflow

Ticket: 8001
To avoid stack overflow

A single signature should not have more than 65k buffers

Ticket: 8001
@catenacyber catenacyber mentioned this pull request Jan 20, 2026
buffer_type_id is a u32

Ticket: 8001
@catenacyber catenacyber marked this pull request as draft January 20, 2026 22:37
@codecov
Copy link

codecov bot commented Jan 20, 2026

Codecov Report

❌ Patch coverage is 78.12500% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.10%. Comparing base (c333b28) to head (8a11901).

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #14661      +/-   ##
==========================================
- Coverage   82.11%   82.10%   -0.01%     
==========================================
  Files        1011     1011              
  Lines      262812   262840      +28     
==========================================
+ Hits       215812   215815       +3     
- Misses      47000    47025      +25     
Flag Coverage Δ
fuzzcorpus 60.25% <50.00%> (+0.07%) ⬆️
livemode 18.71% <46.87%> (+<0.01%) ⬆️
pcap 44.60% <48.43%> (+0.01%) ⬆️
suricata-verify 65.28% <78.12%> (-0.01%) ⬇️
unittests 59.27% <48.43%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@suricata-qa
Copy link

WARNING:

field baseline test %
IPS_AFP_stats_chk
.decoder.unknown_ethertype 21 0 -
.decoder.event.ethernet.unknown_ethertype 21 0 -
TREX_GENERIC_stats_chk
.decoder.unknown_ethertype 23 0 -
.decoder.event.ethernet.unknown_ethertype 23 0 -
.tcp.pkt_on_wrong_thread 0 486 -
.tcp.memuse 1824000000 912000000 50.0%
.tcp.reassembly_memuse 2394336 1187928 49.61%
.flow.tcp_reuse 0 12 -
.flow.end.tcp_state.syn_sent 0 12 -
.flow.end.tcp_state.time_wait 0 11 -
.flow.end.tcp_state.last_ack 0 2 -
.flow.end.tcp_state.close_wait 0 8 -
.app_layer.error.smtp.gap 0 1 -
.app_layer.error.dcerpc_tcp.parser 0 4 -

Pipeline = 29209

@catenacyber
Copy link
Contributor Author

Replaced by #14669

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants