Project

General

Profile

Actions

Bug #3779

closed

Exit on signature with invalid transform pcrexform

Added by Philippe Antoine almost 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=23274

Sample reproducer is
alert tcp any any <> any 1 pcrexform:"[";

Actions #1

Updated by Philippe Antoine almost 4 years ago

  • Status changed from Assigned to In Review

PR in gitlab

Actions #2

Updated by Jeff Lucovsky almost 4 years ago

  • Label Needs backport to 4.1, Needs backport to 5.0 added

The issue also applies to 4.x.y

Actions #3

Updated by Philippe Antoine almost 4 years ago

I do not think this needs backporting as pcrexform is new

Actions #4

Updated by Jeff Lucovsky almost 4 years ago

The underlying issue --

FatalError
-- is in the codebase and has been for ~4 years. A malformed PCRE from a rule could trigger the issue.

Actions #5

Updated by Philippe Antoine almost 4 years ago

A malformed PCRE from a rule could trigger the issue.

I think not since
DetectPcreSetup does not call DetectSetupParseRegexes

Could you show me an example where it fails ?

The use of FatalError seems to me to have been on purpose, for better debugging during development as the pcres used up until pcrexform are hardcoded

Actions #6

Updated by Philippe Antoine almost 4 years ago

  • Label deleted (Needs backport to 4.1, Needs backport to 5.0)
Actions #7

Updated by Philippe Antoine almost 4 years ago

  • Affected Versions 6.0.0beta1 added
  • Affected Versions deleted (5.0.3)
Actions #8

Updated by Victor Julien over 3 years ago

  • Target version set to 6.0.0beta1
Actions #9

Updated by Victor Julien over 3 years ago

  • Status changed from In Review to Closed
  • Private changed from Yes to No
Actions

Also available in: Atom PDF