detect: impose limits on pcrexform

As is done for pcre keyword Ticket: OISF#5409
victorjulien · Jun 29, 2022 · 585e5e0 · 585e5e0
1 parent 45b7aad
commit 585e5e0
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 4 deletions.
diff --git a/src/detect-pcre.c b/src/detect-pcre.c
@@ -64,9 +64,6 @@
 #define PARSE_CAPTURE_REGEX "\\(\\?P\\<([A-z]+)\\_([A-z0-9_]+)\\>"
 #define PARSE_REGEX         "(?<!\\\\)/(.*(?<!(?<!\\\\)\\\\))/([^\"]*)"
 
-#define SC_MATCH_LIMIT_DEFAULT 3500
-#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
-
 static int pcre_match_limit = 0;
 static int pcre_match_limit_recursion = 0;
 

diff --git a/src/detect-pcre.h b/src/detect-pcre.h
@@ -36,6 +36,9 @@
 
 #define DETECT_PCRE_CAPTURE_MAX         8
 
+#define SC_MATCH_LIMIT_DEFAULT           3500
+#define SC_MATCH_LIMIT_RECURSION_DEFAULT 1500
+
 typedef struct DetectPcreData_ {
     /* pcre options */
     DetectParseRegex parse_regex;

diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
@@ -29,9 +29,11 @@
 #include "detect-engine.h"
 #include "detect-parse.h"
 #include "detect-transform-pcrexform.h"
+#include "detect-pcre.h"
 
 typedef struct DetectTransformPcrexformData {
     pcre2_code *regex;
+    pcre2_match_context *context;
 } DetectTransformPcrexformData;
 
 static int DetectTransformPcrexformSetup (DetectEngineCtx *, Signature *, const char *);
@@ -63,6 +65,7 @@ static void DetectTransformPcrexformFree(DetectEngineCtx *de_ctx, void *ptr)
 {
     if (ptr != NULL) {
         DetectTransformPcrexformData *pxd = (DetectTransformPcrexformData *) ptr;
+        pcre2_match_context_free(pxd->context);
         pcre2_code_free(pxd->regex);
         SCFree(pxd);
     }
@@ -88,6 +91,13 @@ static int DetectTransformPcrexformSetup (DetectEngineCtx *de_ctx, Signature *s,
         SCReturnInt(-1);
     }
 
+    pxd->context = pcre2_match_context_create(NULL);
+    if (pxd->context == NULL) {
+        SCFree(pxd);
+        SCReturnInt(-1);
+    }
+    pcre2_set_match_limit(pxd->context, SC_MATCH_LIMIT_DEFAULT);
+    pcre2_set_recursion_limit(pxd->context, SC_MATCH_LIMIT_RECURSION_DEFAULT);
     int en;
     PCRE2_SIZE eo;
     pxd->regex = pcre2_compile((PCRE2_SPTR8)regexstr, PCRE2_ZERO_TERMINATED, 0, &en, &eo, NULL);
@@ -98,6 +108,7 @@ static int DetectTransformPcrexformSetup (DetectEngineCtx *de_ctx, Signature *s,
                 "pcre2 compile of \"%s\" failed at "
                 "offset %d: %s",
                 regexstr, (int)eo, buffer);
+        pcre2_match_context_free(pxd->context);
         SCFree(pxd);
         SCReturnInt(-1);
     }
@@ -130,7 +141,7 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options)
     DetectTransformPcrexformData *pxd = options;
 
     pcre2_match_data *match = pcre2_match_data_create_from_pattern(pxd->regex, NULL);
-    int ret = pcre2_match(pxd->regex, (PCRE2_SPTR8)input, input_len, 0, 0, match, NULL);
+    int ret = pcre2_match(pxd->regex, (PCRE2_SPTR8)input, input_len, 0, 0, match, pxd->context);
 
     if (ret > 0) {
         const char *str;