Project

General

Profile

Actions
Copy link

Bug #3568

closed
VJ JL

rules: bad rule leads to memory exhaustion

Bug #3568: rules: bad rule leads to memory exhaustion

Added by Victor Julien about 6 years ago. Updated about 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jeff Lucovsky
Target version:
6.0.0beta1
Affected Versions:
Effort:
Difficulty:
Label:

Description

./src/fuzz_siginit ~/Downloads/clusterfuzz-testcase-minimized-fuzz_siginit-5659361696546816

Looks like it is related to 

  11,67%  fuzz_siginit                     [.] IPOnlyCIDRItemNew
   4,23%  fuzz_siginit                     [.] IPOnlyCIDRItemParseSingle

Which suggests some kind of endless loop in the cidr parsing code.

Probably needs backporting too.

Files

Download all files
clusterfuzz-testcase-minimized-fuzz_siginit-5659361696546816 (195 Bytes) clusterfuzz-testcase-minimized-fuzz_siginit-5659361696546816 Victor Julien, 03/29/2020 01:23 PM
oom-78bdf2e728b5d507654e9a694dcfaa0dbcc0f24d (1.48 KB) oom-78bdf2e728b5d507654e9a694dcfaa0dbcc0f24d Victor Julien, 04/06/2020 07:47 PM

Related issues 1 (0 open — 1 closed)

Has duplicate Suricata - Bug #3662: Signature with an IP range creates one IPOnlyCIDRItem by IP addressClosedPhilippe AntoineActions

JL Updated by Jeff Lucovsky about 6 years ago Actions
Copy link
 #2

  • Status changed from Assigned to In Review

VJ Updated by Victor Julien about 6 years ago Actions
Copy link
 #3

Attaching another case that my local instance said caused an OOM condition (the limit is set to ~2.5G)

PA Updated by Philippe Antoine almost 6 years ago Actions
Copy link
 #4

  • Has duplicate Bug #3662: Signature with an IP range creates one IPOnlyCIDRItem by IP address added

VJ Updated by Victor Julien almost 6 years ago Actions
Copy link
 #5

  • Status changed from In Review to Closed
  • Priority changed from High to Normal

Fixed through #3662

JL Updated by Jeff Lucovsky about 5 years ago Actions
Copy link
 #6

  • Private changed from Yes to No
Actions
Copy link

Also available in: PDF Atom