Bug #3568: rules: bad rule leads to memory exhaustion - Suricata - Open Information Security Foundation

Actions

Bug #3568

closed

rules: bad rule leads to memory exhaustion

Added by Victor Julien about 4 years ago. Updated about 3 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Target version:

Affected Versions:

Effort:

Difficulty:

Label:

Description

./src/fuzz_siginit ~/Downloads/clusterfuzz-testcase-minimized-fuzz_siginit-5659361696546816

Looks like it is related to

  11,67%  fuzz_siginit                     [.] IPOnlyCIDRItemNew
   4,23%  fuzz_siginit                     [.] IPOnlyCIDRItemParseSingle

Which suggests some kind of endless loop in the cidr parsing code.

Probably needs backporting too.

Files

Download all files

clusterfuzz-testcase-minimized-fuzz_siginit-5659361696546816 (195 Bytes) clusterfuzz-testcase-minimized-fuzz_siginit-5659361696546816		Victor Julien, 03/29/2020 01:23 PM
oom-78bdf2e728b5d507654e9a694dcfaa0dbcc0f24d (1.48 KB) oom-78bdf2e728b5d507654e9a694dcfaa0dbcc0f24d		Victor Julien, 04/06/2020 07:47 PM

Related issues 1 (0 open — 1 closed)

Actions

#1

Updated by Victor Julien about 4 years ago

Found by: https://oss-fuzz.com/testcase-detail/5659361696546816

Actions

#2

Updated by Jeff Lucovsky about 4 years ago

Status changed from Assigned to In Review

Actions

#3

Updated by Victor Julien about 4 years ago

File oom-78bdf2e728b5d507654e9a694dcfaa0dbcc0f24d oom-78bdf2e728b5d507654e9a694dcfaa0dbcc0f24d added

Attaching another case that my local instance said caused an OOM condition (the limit is set to ~2.5G)

Actions

#4

Updated by Philippe Antoine about 4 years ago

Has duplicate Bug #3662: Signature with an IP range creates one IPOnlyCIDRItem by IP address added

Actions

#5

Updated by Victor Julien almost 4 years ago

Status changed from In Review to Closed
Priority changed from High to Normal

Fixed through #3662

Actions

#6

Updated by Jeff Lucovsky about 3 years ago

Private changed from Yes to No

Actions

Also available in: Atom PDF