Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

signature: avoids overflow from VariableNameHash #4083

Closed

Conversation

catenacyber
Copy link
Contributor

Link to redmine ticket:
None

Describe changes:

  • Avoids a read heap buffer overflow due to VariableNameHash not limiting its hash size

Found by fuzzing SigInit

Stack trace is following

==12==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x62d000030400 at pc 0x000000ae8bc6 bp 0x7ffd627f4a30 sp 0x7ffd627f4a28
READ of size 8 at 0x62d000030400 thread T0 (Suricata-Main)
SCARINESS: 23 (8-byte-read-heap-buffer-overflow)
#0 0xae8bc5 in HashListTableAdd /src/suricata/src/util-hashlist.c:135:9
#1 0xb9f0d5 in VariableNameGetIdx /src/suricata/src/util-var-name.c:193:9
#2 0xb9ed4f in VarNameStoreSetupAdd /src/suricata/src/util-var-name.c:324:10
#3 0x7e7f27 in DetectFlowbitSetup /src/suricata/src/detect-flowbits.c:249:15
#4 0x855dad in SigParseOptions /src/suricata/src/detect-parse.c:742:13
#5 0x84df20 in SigParse /src/suricata/src/detect-parse.c:1174:19
#6 0x84a55a in SigInitHelper /src/suricata/src/detect-parse.c:1798:9
#7 0x849fbe in SigInit /src/suricata/src/detect-parse.c:1944:16

@catenacyber catenacyber requested a review from a team as a code owner August 1, 2019 13:50
@catenacyber catenacyber closed this Aug 1, 2019
@catenacyber catenacyber deleted the sig-varname-hashoverflow-v1 branch October 1, 2019 14:46
catenacyber added a commit to catenacyber/suricata that referenced this pull request Jul 19, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Aug 30, 2023
catenacyber added a commit to catenacyber/suricata that referenced this pull request Aug 30, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
jasonish pushed a commit to jasonish/suricata that referenced this pull request Aug 30, 2023
jasonish pushed a commit to jasonish/suricata that referenced this pull request Aug 30, 2023
jasonish pushed a commit to jasonish/suricata that referenced this pull request Aug 31, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Sep 18, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Sep 18, 2023
victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Nov 17, 2023
catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 19, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Nov 19, 2023
victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Nov 20, 2023
catenacyber added a commit to catenacyber/suricata that referenced this pull request Dec 21, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Dec 21, 2023
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Feb 12, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Mar 21, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Mar 21, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 12, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 12, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
catenacyber added a commit to catenacyber/suricata that referenced this pull request Apr 12, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
victorjulien pushed a commit to victorjulien/suricata that referenced this pull request Apr 13, 2024
+ remove double definition of IPPairLock

Ticket: OISF#4083
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

1 participant