From 2e27a5df6b6cee7a3fdd4b6e0709a38f925ac4ad Mon Sep 17 00:00:00 2001 From: Wolfgang Hotwagner Date: Fri, 17 Nov 2017 17:47:41 +0000 Subject: [PATCH] conf: fix NULL-pointer dereference in ParseSizeString If someone accidently writes invalid characters in some parts of the suricata.yaml-configfile, the size-parameter of the ParseSizeString-function becomes NULL and gets dereferenced. Suricata crashes with SEGV. This commit fixes Ticket #2274 The following config value leads to a Segfault: app-layer.protocols.smtp.inspected-tracker.content-inspect-window: *4096 --- src/util-misc.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/util-misc.c b/src/util-misc.c index 7e7f03d135..e41554a078 100644 --- a/src/util-misc.c +++ b/src/util-misc.c @@ -75,6 +75,18 @@ static int ParseSizeString(const char *size, double *res) *res = 0; + if (size == NULL) { + SCLogError(SC_ERR_INVALID_ARGUMENTS,"invalid size argument - NULL. Valid size " + "argument should be in the format - \n" + "xxx <- indicates it is just bytes\n" + "xxxkb or xxxKb or xxxKB or xxxkB <- indicates kilobytes\n" + "xxxmb or xxxMb or xxxMB or xxxmB <- indicates megabytes\n" + "xxxgb or xxxGb or xxxGB or xxxgB <- indicates gigabytes.\n" + ); + retval = -2; + goto end; + } + pcre_exec_ret = pcre_exec(parse_regex, parse_regex_study, size, strlen(size), 0, 0, ov, MAX_SUBSTRINGS); if (!(pcre_exec_ret == 2 || pcre_exec_ret == 3)) {