Project

General

Profile

Actions
Copy link

Bug #5188

closed

SSL : over allocation for certificates

Added by Philippe Antoine almost 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
7.0.0-beta1
Affected Versions:
6.0.4
Effort:
Difficulty:
Label:
Needs backport, Needs backport to 5.0, Needs backport to 6.0

Description

Found by Coverity

Untrusted allocation size (TAINTED_SCALAR)

in curr_connp->trec = SCMalloc(curr_connp->trec_len); where trec_len is a u24 read from the network, so suricata can call malloc with up to 16Mbytes even if there is no data yet to fill them...

Related issues 2 (0 open — 2 closed)

Copied to Suricata - Bug #5192: SSL : over allocation for certificatesClosedShivani BhardwajActions
Copied to Suricata - Bug #5193: SSL : over allocation for certificatesClosedJeff LucovskyActions
Actions
Copy link
 #1

Updated by Philippe Antoine almost 3 years ago

Luckily for Suricata, OSes seem to prevent this malloc from being really reserved by the system until it is really used...

Actions
Copy link
 #2

Updated by Philippe Antoine almost 3 years ago

  • Status changed from New to In Review
Actions
Copy link
 #3

Updated by Shivani Bhardwaj almost 3 years ago

  • Copied to Bug #5192: SSL : over allocation for certificates added
Actions
Copy link
 #4

Updated by Shivani Bhardwaj almost 3 years ago

  • Copied to Bug #5193: SSL : over allocation for certificates added
Actions
Copy link
 #5

Updated by Victor Julien over 2 years ago

  • Status changed from In Review to Closed

https://github.com/OISF/suricata/pull/7139

Coverity scan rerun confirms the fix.

Actions
Copy link

Also available in: Atom PDF