Project

General

Profile

Actions
Copy link

Bug #3662

closed
PA PA

Signature with an IP range creates one IPOnlyCIDRItem by IP address

Bug #3662: Signature with an IP range creates one IPOnlyCIDRItem by IP address

Added by Philippe Antoine about 6 years ago. Updated about 6 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
6.0.0beta1
Affected Versions:
5.0.2
Effort:
Difficulty:
Label:
Needs backport, Needs backport to 4.1, Needs backport to 5.0

Description

Found by fuzzing https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21817

For example, when we want the range 41.232.107.2-43.252.37.6, it creates millions of IPOnlyCIDRItem because it gives them all a netmask of 32

Solution is to extend the net mask so that it uses 

41.232.107.3/32
41.232.107.4/30
41.232.107.8/29
41.232.107.16/28
41.232.107.32/27
41.232.107.64/26
41.232.107.128/25
41.232.108.0/22
41.232.112.0/20
41.232.128.0/17
41.233.0.0/16
41.234.0.0/15
41.236.0.0/14
41.240.0.0/12
42.0.0.0/8
43.0.0.0/9
43.128.0.0/10
43.192.0.0/11
43.224.0.0/12
43.240.0.0/13
43.248.0.0/14
43.252.0.0/19
43.252.32.0/22
43.252.36.0/24
43.252.37.0/30
43.252.37.4/31
43.252.37.6/32

Related issues 3 (0 open — 3 closed)

Is duplicate of Suricata - Bug #3568: rules: bad rule leads to memory exhaustionClosedJeff LucovskyActions
Copied to Suricata - Bug #3667: Signature with an IP range creates one IPOnlyCIDRItem by IP addressClosedJeff LucovskyActions
Copied to Suricata - Bug #3668: Signature with an IP range creates one IPOnlyCIDRItem by IP addressClosedShivani BhardwajActions

PA Updated by Philippe Antoine about 6 years ago Actions
Copy link
 #1

  • Status changed from New to In Review

PA Updated by Philippe Antoine about 6 years ago Actions
Copy link
 #2

  • Is duplicate of Bug #3568: rules: bad rule leads to memory exhaustion added

JL Updated by Jeff Lucovsky about 6 years ago Actions
Copy link
 #3

  • Copied to Bug #3667: Signature with an IP range creates one IPOnlyCIDRItem by IP address added

JL Updated by Jeff Lucovsky about 6 years ago Actions
Copy link
 #4

  • Copied to Bug #3668: Signature with an IP range creates one IPOnlyCIDRItem by IP address added

VJ Updated by Victor Julien about 6 years ago Actions
Copy link
 #5

  • Status changed from In Review to Closed
  • Assignee set to Philippe Antoine
  • Target version set to 6.0.0beta1

JL Updated by Jeff Lucovsky about 6 years ago Actions
Copy link
 #6

  • Subject changed from Signature with an IP range creates one IPOnlyCIDRItem by signe IP address to Signature with an IP range creates one IPOnlyCIDRItem by IP address
Actions
Copy link

Also available in: PDF Atom