Suricata

/* 23 - This is the largest string (octal, with a zero prefix) that
 *      will not overflow uint64_t.  The only way this length
 *      could be over 23 and still not overflow is if it were zero
 *      prefixed and we only support 1 byte of zero prefix for octal.
 *
 * "01777777777777777777777" = 0xffffffffffffffff
 *
 * 8 - Without string, the maximum byte extract count is 8.
 */
static inline bool DetectBytetestValidateNbytesOnly(const DetectBytetestData *data, uint32_t nbytes)
{
    return ((data->flags & DETECT_BYTETEST_STRING) && nbytes <= 23) || (nbytes <= 8);
}

static bool DetectBytetestValidateNbytes(
        const DetectBytetestData *data, uint32_t nbytes, const char *optstr)
{
    if (!DetectBytetestValidateNbytesOnly(data, nbytes)) {
        if (data->flags & DETECT_BYTETEST_STRING) {
            /* 23 - This is the largest string (octal, with a zero prefix) that
             *      will not overflow uint64_t.  The only way this length
             *      could be over 23 and still not overflow is if it were zero
             *      prefixed and we only support 1 byte of zero prefix for octal.
             *
             * "01777777777777777777777" = 0xffffffffffffffff
             */
            if (nbytes > 23) {
                SCLogError("Cannot test more than 23 bytes with \"string\": %s", optstr);
            }
        } else {
            if (nbytes > 8) {
                SCLogError("Cannot test more than 8 bytes without \"string\": %s", optstr);
            }
            if (data->base != DETECT_BYTETEST_BASE_UNSET) {
                SCLogError("Cannot use a base without \"string\": %s", optstr);
            }
        }

    /* Validate the number of bytes we are testing
     * If the validation is successful, we know that
     * it contains a value <= 23. Thus, we can
     * safely cast it when extracting bytes
     */
    if (data->flags & DETECT_BYTEJUMP_NBYTES_VAR) {
        if (!DetectBytejumpValidateNbytesOnly(data, nbytes)) {
            SCLogDebug("Invalid byte_jump nbytes " 
                       "seen in byte_jump - %u",
                    nbytes);
            SCReturnBool(false);
        }
    }

int ByteExtractString(uint64_t *res, int base, size_t len, const char *str, bool strict)
{
    const char *ptr = str;
    char *endptr = NULL;

    /* 23 - This is the largest string (octal, with a zero prefix) that
     *      will not overflow uint64_t.  The only way this length
     *      could be over 23 and still not overflow is if it were zero
     *      prefixed and we only support 1 byte of zero prefix for octal.
     *
     * "01777777777777777777777" = 0xffffffffffffffff
     */
    char strbuf[24];