Bug #4536: SWF decompression overread - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #4536

closed

SWF decompression overread

Added by Philippe Antoine almost 3 years ago. Updated over 2 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

7.0.0-beta1

Affected Versions:

6.0.2

Effort:

Difficulty:

Label:

Needs backport to 5.0, Needs backport to 6.0

Description

While decompressing a swf file, the computation of compressed_data_len is wrong as it does not handle the offset start

Related issues 4 (0 open — 4 closed)

Actions

Copy link

Updated by Philippe Antoine almost 3 years ago

Gitlab MR

Swf overread seems to be not triggered because StreamingBufferGetDataAtOffset returns a pointer to a bigger buffer than said...

Dummy patch to trigger it

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index 49c297ab8..b81d9b1fb 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -377,7 +377,9 @@ static InspectionBuffer *HttpServerBodyGetDataCallback(DetectEngineThreadCtx *de
         if (swf_file_type == FILE_SWF_ZLIB_COMPRESSION ||
             swf_file_type == FILE_SWF_LZMA_COMPRESSION)
         {
-            (void)FileSwfDecompression(data, data_len,
+            void *lol2 = malloc(data_len);
+            memcpy(lol2, data, data_len);
+            (void)FileSwfDecompression(lol2, data_len,
                                        det_ctx,
                                        buffer,
                                        htp_state->cfg->swf_compression_type,

Actions

Copy link