Project

General

Profile

Actions
Copy link

Bug #801

closed
VJ VJ

deadlock in flowvar capture code

Bug #801: deadlock in flowvar capture code

Added by Victor Julien about 13 years ago. Updated about 13 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
1.4.2
Affected Versions:
Effort:
Difficulty:
Label:

Description

Flowvars can be captured using pcre statements, from any buffer pcre can inspect. Problem is that the pcre match code is called both with locked and unlocked flows. Locked in case of inspection of http buffers, unlocked in case of packets and stream chunks. The flowvar storage code tries to lock the flow as well, so in the case of http buffers, we deadlock.

This affects only rules that have a construct like:

pcre:"/(?P<flow_uri>.*)/Ui";

This captures the entire uri into a flowvar called "uri".

As no public ruleset uses this impact is low.

Actions
Copy link

Also available in: PDF Atom