Project

General

Profile

Actions

Bug #3790

closed

Stack overflow in DetectFlowbitsAnalyze

Added by Jeff Lucovsky almost 4 years ago. Updated over 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

When doing torture tests, I discovered a stack overflow in DetectFlowbitsAnalyze. I have made a PR to github @ https://github.com/OISF/suricata/pull/5103

Overflow happens when number of flowbits is sufficiently large which in turn causes array containing FBAnalyze structs to be greater than stack size.

Changeset should apply cleanly to 5.x too.


Related issues 1 (0 open1 closed)

Copied from Suricata - Bug #3783: Stack overflow in DetectFlowbitsAnalyzeClosedAntti TönkyräActions
Actions #1

Updated by Jeff Lucovsky almost 4 years ago

  • Copied from Bug #3783: Stack overflow in DetectFlowbitsAnalyze added
Actions #2

Updated by Jeff Lucovsky over 3 years ago

  • Status changed from Assigned to In Review
Actions #4

Updated by Jeff Lucovsky over 3 years ago

  • Status changed from In Review to Closed
Actions

Also available in: Atom PDF