Project

General

Profile

Actions

Bug #3783

closed

Stack overflow in DetectFlowbitsAnalyze

Added by Antti Tönkyrä almost 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 5.0

Description

When doing torture tests, I discovered a stack overflow in DetectFlowbitsAnalyze. I have made a PR to github @ https://github.com/OISF/suricata/pull/5103

Overflow happens when number of flowbits is sufficiently large which in turn causes array containing FBAnalyze structs to be greater than stack size.

Changeset should apply cleanly to 5.x too.


Related issues 1 (0 open1 closed)

Copied to Suricata - Bug #3790: Stack overflow in DetectFlowbitsAnalyzeClosedJeff LucovskyActions
Actions

Also available in: Atom PDF