Skip to content

Stack 8001 v11 #14669

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
catenacyber wants to merge 4 commits into from
+88 −41
Closed

Stack 8001 v11 #14669

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
afcb205
datasets: adds safety check before stack allocation
catenacyber Jan 16, 2026
6edeb4a
detect: allocate sids_array on the heap
catenacyber Jan 16, 2026
81a8102
detect: add debug validation about nlists
catenacyber Jan 16, 2026
7a117d7
detect: allocate arrays on the heap
catenacyber Jan 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions src/datasets-context-json.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -895,6 +895,12 @@ int DatajsonAddSerialized(Dataset *set, const char *value, const char *json)
int ret = -1;
switch (set->type) {
case DATASET_TYPE_STRING: {
if (strlen(value) > UINT16_MAX) {
// size check before stack allocation
// should never happen as unix socket callers limits it to 4k
SCFree(jvalue.value);
return -1;
}
uint32_t decoded_size = SCBase64DecodeBufferSize((uint32_t)strlen(value));
uint8_t decoded[decoded_size];
uint32_t num_decoded = SCBase64Decode(
Expand Down
11 changes: 9 additions & 2 deletions src/detect-engine-analyzer.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1560,8 +1560,14 @@ void DumpPatterns(DetectEngineCtx *de_ctx)
return;

SCJsonBuilder *root_jb = SCJbNewObject();
SCJsonBuilder *arrays[de_ctx->buffer_type_id];
memset(&arrays, 0, sizeof(SCJsonBuilder *) * de_ctx->buffer_type_id);
if (root_jb == NULL) {
return;
}
SCJsonBuilder **arrays = SCCalloc(de_ctx->buffer_type_id, sizeof(SCJsonBuilder *));
if (arrays == NULL) {
SCJbFree(root_jb);
return;
}

SCJbOpenArray(root_jb, "buffers");

Expand Down Expand Up @@ -1629,6 +1635,7 @@ void DumpPatterns(DetectEngineCtx *de_ctx)
}
SCMutexUnlock(&g_rules_analyzer_write_m);
SCJbFree(root_jb);
SCFree(arrays);

HashListTableFree(de_ctx->pattern_hash_table);
de_ctx->pattern_hash_table = NULL;
Expand Down
44 changes: 28 additions & 16 deletions src/detect-engine-build.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -602,6 +602,13 @@ static bool RuleMpmIsNegated(const Signature *s)
return (cd->flags & DETECT_CONTENT_NEGATED) ? true : false;
}

typedef struct MpmStat {
uint32_t total;
uint32_t cnt;
uint32_t min;
uint32_t max;
} MpmStat;

static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
const SigGroupHead *sgh, const int add_rules, const int add_mpm_stats)
{
Expand All @@ -620,13 +627,12 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,

int max_buffer_type_id = de_ctx->buffer_type_id;

struct {
uint32_t total;
uint32_t cnt;
uint32_t min;
uint32_t max;
} mpm_stats[max_buffer_type_id];
memset(mpm_stats, 0x00, sizeof(mpm_stats));
MpmStat *mpm_stats = NULL;
if (add_mpm_stats) {
mpm_stats = SCCalloc(max_buffer_type_id, sizeof(MpmStat));
if (mpm_stats == NULL)
return NULL;
}

uint32_t alstats[g_alproto_max];
memset(alstats, 0, g_alproto_max * sizeof(uint32_t));
Expand All @@ -636,12 +642,16 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
memset(alproto_mpm_bufs, 0, sizeof(alproto_mpm_bufs));

DEBUG_VALIDATE_BUG_ON(sgh->init == NULL);
if (sgh->init == NULL)
if (sgh->init == NULL) {
SCFree(mpm_stats);
return NULL;
}

SCJsonBuilder *js = SCJbNewObject();
if (unlikely(js == NULL))
if (unlikely(js == NULL)) {
SCFree(mpm_stats);
return NULL;
}

SCJbSetUint(js, "id", sgh->id);

Expand Down Expand Up @@ -732,13 +742,14 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,
mpms_max = w;

BUG_ON(mpm_list >= max_buffer_type_id);
mpm_stats[mpm_list].total += w;
mpm_stats[mpm_list].cnt++;
if (mpm_stats[mpm_list].min == 0 || w < mpm_stats[mpm_list].min)
mpm_stats[mpm_list].min = w;
if (w > mpm_stats[mpm_list].max)
mpm_stats[mpm_list].max = w;

if (mpm_stats != NULL) {
mpm_stats[mpm_list].total += w;
mpm_stats[mpm_list].cnt++;
if (mpm_stats[mpm_list].min == 0 || w < mpm_stats[mpm_list].min)
mpm_stats[mpm_list].min = w;
if (w > mpm_stats[mpm_list].max)
mpm_stats[mpm_list].max = w;
}
mpm_cnt++;

if (w < 10) {
Expand Down Expand Up @@ -863,6 +874,7 @@ static SCJsonBuilder *RulesGroupPrintSghStats(const DetectEngineCtx *de_ctx,

SCJbSetUint(js, "score", sgh->init->score);
SCJbClose(js);
SCFree(mpm_stats);

return js;
}
Expand Down
68 changes: 45 additions & 23 deletions src/detect-engine-mpm.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1149,6 +1149,7 @@ void RetrieveFPForSig(const DetectEngineCtx *de_ctx, Signature *s)
return;

const int nlists = s->init_data->max_content_list_id + 1;
DEBUG_VALIDATE_BUG_ON(nlists > UINT16_MAX);
int pos_sm_list[nlists];
int neg_sm_list[nlists];
memset(pos_sm_list, 0, nlists * sizeof(int));
Expand Down Expand Up @@ -1522,18 +1523,23 @@ static const DetectBufferMpmRegistry *GetByMpmStore(
void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
{
HashListTableBucket *htb = NULL;
uint32_t *appstats = NULL;
uint32_t *pktstats = NULL;
uint32_t *framestats = NULL;

uint32_t stats[MPMB_MAX] = {0};
DEBUG_VALIDATE_BUG_ON(de_ctx->buffer_type_id > UINT16_MAX);
int app_mpms_cnt = de_ctx->buffer_type_id;
uint32_t appstats[app_mpms_cnt + 1]; // +1 to silence scan-build
memset(&appstats, 0x00, sizeof(appstats));
int pkt_mpms_cnt = de_ctx->buffer_type_id;
uint32_t pktstats[pkt_mpms_cnt + 1]; // +1 to silence scan-build
memset(&pktstats, 0x00, sizeof(pktstats));
int frame_mpms_cnt = de_ctx->buffer_type_id;
uint32_t framestats[frame_mpms_cnt + 1]; // +1 to silence scan-build
memset(&framestats, 0x00, sizeof(framestats));
appstats = SCCalloc(de_ctx->buffer_type_id, sizeof(uint32_t));
if (appstats == NULL) {
goto end;
}
pktstats = SCCalloc(de_ctx->buffer_type_id, sizeof(uint32_t));
if (pktstats == NULL) {
goto end;
}
framestats = SCCalloc(de_ctx->buffer_type_id, sizeof(uint32_t));
if (framestats == NULL) {
goto end;
}

for (htb = HashListTableGetListHead(de_ctx->mpm_hash_table);
htb != NULL;
Expand Down Expand Up @@ -1609,6 +1615,13 @@ void MpmStoreReportStats(const DetectEngineCtx *de_ctx)
um = um->next;
}
}
end:
if (appstats)
SCFree(appstats);
if (pktstats)
SCFree(pktstats);
if (framestats)
SCFree(framestats);
}

/**
Expand Down Expand Up @@ -1733,11 +1746,12 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
uint32_t cnt = 0;
int direction = 0;
uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;
uint8_t sids_array[max_sid];
memset(sids_array, 0x00, max_sid);
int sgh_mpm_context = 0;
int sm_list = DETECT_SM_LIST_PMATCH;

uint8_t *sids_array = SCCalloc(1, max_sid);
if (sids_array == NULL) {
return NULL;
}
switch (buf) {
case MPMB_TCP_PKT_TS:
case MPMB_TCP_PKT_TC:
Expand Down Expand Up @@ -1826,8 +1840,10 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
}
}

if (cnt == 0)
if (cnt == 0) {
SCFree(sids_array);
return NULL;
}

MpmStore lookup = { sids_array, max_sid, direction, buf, sm_list, 0, 0, NULL };

Expand All @@ -1839,6 +1855,7 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,
uint8_t *sids = SCCalloc(1, max_sid);
if (sids == NULL) {
SCFree(copy);
SCFree(sids_array);
return NULL;
}

Expand All @@ -1852,8 +1869,10 @@ MpmStore *MpmStorePrepareBuffer(DetectEngineCtx *de_ctx, SigGroupHead *sgh,

MpmStoreSetup(de_ctx, copy);
MpmStoreAdd(de_ctx, copy);
SCFree(sids_array);
return copy;
} else {
SCFree(sids_array);
return result;
}
}
Expand Down Expand Up @@ -2069,12 +2088,12 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
const int max_buffer_id = de_ctx->buffer_type_id + 1;
const uint32_t max_sid = DetectEngineGetMaxSigId(de_ctx) / 8 + 1;

AppProto engines[max_buffer_id][g_alproto_max];
memset(engines, 0, sizeof(engines));
int engines_idx[max_buffer_id];
memset(engines_idx, 0, sizeof(engines_idx));
int types[max_buffer_id];
memset(types, 0, sizeof(types));
AppProto *engines = SCCalloc(max_buffer_id * g_alproto_max, sizeof(AppProto));
BUG_ON(engines == NULL);
int *engines_idx = SCCalloc(max_buffer_id, sizeof(int));
BUG_ON(engines_idx == NULL);
int *types = SCCalloc(max_buffer_id, sizeof(int));
BUG_ON(types == NULL);

/* flag the list+directions we have engines for as active */
for (DetectBufferMpmRegistry *a = de_ctx->pkt_mpms_list; a != NULL; a = a->next) {
Expand All @@ -2097,7 +2116,7 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
const bool add_tc = ((a->direction == SIG_FLAG_TOCLIENT) && SGH_DIRECTION_TC(sh));
if (add_ts || add_tc) {
types[a->sm_list] = a->type;
engines[a->sm_list][engines_idx[a->sm_list]++] = a->frame_v1.alproto;
engines[g_alproto_max * a->sm_list + engines_idx[a->sm_list]++] = a->frame_v1.alproto;

DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->frame_v1.alproto };
DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
Expand All @@ -2117,7 +2136,7 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
const bool add_tc = ((a->direction == SIG_FLAG_TOCLIENT) && SGH_DIRECTION_TC(sh));
if (add_ts || add_tc) {
types[a->sm_list] = a->type;
engines[a->sm_list][engines_idx[a->sm_list]++] = a->app_v2.alproto;
engines[g_alproto_max * a->sm_list + engines_idx[a->sm_list]++] = a->app_v2.alproto;

DetectBufferInstance lookup = { .list = a->sm_list, .alproto = a->app_v2.alproto };
DetectBufferInstance *instance = HashListTableLookup(bufs, &lookup, 0);
Expand Down Expand Up @@ -2150,7 +2169,7 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
case DETECT_BUFFER_MPM_TYPE_FRAME:
case DETECT_BUFFER_MPM_TYPE_APP: {
for (int e = 0; e < engines_idx[list]; e++) {
const AppProto alproto = engines[list][e];
const AppProto alproto = engines[list * g_alproto_max + e];
if (!(AppProtoEquals(s->alproto, alproto) || s->alproto == 0))
continue;

Expand Down Expand Up @@ -2311,6 +2330,9 @@ static void PrepareMpms(DetectEngineCtx *de_ctx, SigGroupHead *sh)
}
}
HashListTableFree(bufs);
SCFree(engines);
SCFree(engines_idx);
SCFree(types);
}

/** \brief Prepare the pattern matcher ctx in a sig group head.
Expand Down
Loading