Actions
Security #7959
closed
PA
PA
detect/entropy: null deref when used with base64_data
Security #7959:
detect/entropy: null deref when used with base64_data
Severity:
HIGH
Disclosure Date:
10/29/2025
GHSA:
Description
Found by oss-fuzz:
https://issues.oss-fuzz.com/u/1/issues/447714701
When used with base64_data suricata will segfault
Rule
dROp ip :: 3 <> :: 1 base64_decode;base64_datA;entropy:value 0;sid:6;
Stack:
==8300==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x7ff802b94b32 bp 0x7ff7be694d90 sp 0x7ff7be694d90 T0)
==8300==The signal is caused by a READ memory access.
==8300==Hint: address points to the zero page.
#0 0x7ff802b94b32 in _platform_strlen+0x12 (libsystem_platform.dylib:x86_64+0x1b32)
#1 0x000103a11392 in strlen+0x32 (libclang_rt.asan_osx_dynamic.dylib:x86_64h+0x19392)
#2 0x000101d30806 in VariableNameHash util-var-name.c:339
#3 0x000101c98ab7 in HashListTableLookup util-hashlist.c:253
#4 0x000101d31010 in VarNameStoreRegister util-var-name.c:162
#5 0x000101a66a0a in DetectEntropySetup detect-entropy.c
#6 0x000101ad6c86 in SigParse detect-parse.c:1896
#7 0x000101ad18b5 in SigInitHelper detect-parse.c:2907
#8 0x000101acecc6 in SigInitDo detect-parse.c:3054
#9 0x000101858679 in LLVMFuzzerTestOneInput fuzz_siginit.c:53
Actions