Project

General

Profile

Actions

Bug #7769

open

DetectFileHashParse: remove redundant de_ctx->rule_file != NULL check

Added by Boris Tonofa 23 days ago. Updated 8 days ago.

Status:
In Review
Priority:
Normal
Assignee:
Target version:

Description

When Suricata parses rules it invokes DetectFileHashParse() to turn a filemd5/sha1/sha256 keyword into an in-memory hash table. If the rules are supplied from memory, the parser context field de_ctx->rule_file is NULL; nevertheless the code still executes SCStrdup(de_ctx->rule_file). Because strdup(NULL) dereferences a null pointer inside strlen(), Suricata crashes with SIGSEGV during the rule-loading phase.

Actions #1

Updated by Boris Tonofa 11 days ago

  • Subject changed from DetectFileHashParse crashes when de_ctx->rule_file is NULL (strdup → SIGSEGV) to DetectFileHashParse: remove redundant de_ctx->rule_file != NULL check

In DetectFileHashParse the static analyzer reports a warning for

rule_filename = SCStrdup(de_ctx->rule_file);

because a few lines later the code still performs

if (de_ctx->rule_file != NULL) {
    
}

de_ctx->rule_file is already guaranteed to be non-NULL at this point, so the run-time check is redundant. Remove the if (de_ctx->rule_file != NULL) block to eliminate the false positive and simplify the codebase.

Actions #2

Updated by Philippe Antoine 8 days ago

  • Status changed from New to In Review
Actions

Also available in: Atom PDF