Project

General

Profile

Actions
Copy link

Bug #6656

closed
PA PA

detect/requires: assertion failed !(ret == -4)

Bug #6656: detect/requires: assertion failed !(ret == -4)

Added by Philippe Antoine over 2 years ago. Updated about 2 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Philippe Antoine
Target version:
8.0.0-beta1
Affected Versions:
git main
Effort:
Difficulty:
Label:

Description

Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65320

Reproducer is drop ip :: 0 <> :: 0 requireS:feature;sid:1;

Subtasks 1 (0 open — 1 closed)

Bug #6700: detect/requires: assertion failed !(ret == -4) (7.0.x backport)ClosedJason IshActions

Related issues 1 (0 open — 1 closed)

Related to Suricata - Feature #5972: rules: "requires" keyword representing the minimum version of suricata to support the ruleClosedJason IshActions

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #1

The bug looks like
alert ip any any -> any any (requireS:feature geoip;sid:1;) triggers with an uppercase S in requireS
alert ip any any -> any any (requires:feature geoip;sid:1;) does not trigger with all lowercase requires

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #2

SigTableGet uses strcasecmp and so should definition of requires_only instead of using strcmp

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #3

  • Status changed from New to In Review

PA Updated by Philippe Antoine over 2 years ago Actions
Copy link
 #4

  • Status changed from In Review to Closed
  • Assignee changed from Jason Ish to Philippe Antoine

JI Updated by Jason Ish over 2 years ago Actions
Copy link
 #5

  • Label Needs backport to 7.0 added

JI Updated by Jason Ish about 2 years ago Actions
Copy link
 #6

  • Related to Feature #5972: rules: "requires" keyword representing the minimum version of suricata to support the rule added

JI Updated by Jason Ish about 2 years ago Actions
Copy link
 #7

  • Status changed from Closed to Resolved

OT Updated by OISF Ticketbot about 2 years ago Actions
Copy link
 #8

  • Subtask #6700 added

OT Updated by OISF Ticketbot about 2 years ago Actions
Copy link
 #9

  • Label deleted (Needs backport to 7.0)

PA Updated by Philippe Antoine about 2 years ago Actions
Copy link
 #10

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: PDF Atom