From 51c6a333d927d6d0f5fab18b9857d09fe0d35a4c Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 16 Sep 2013 16:34:59 +0200 Subject: [PATCH] geoip: never try to store more locations than possible (Coverity 1038517) --- src/detect-geoip.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/detect-geoip.c b/src/detect-geoip.c index f3a865d3f7..a7a1d05eef 100644 --- a/src/detect-geoip.c +++ b/src/detect-geoip.c @@ -268,6 +268,12 @@ static DetectGeoipData *DetectGeoipDataParse (char *str) geoipdata->flags |= GEOIP_MATCH_NEGATED; prevpos++; /* dot not copy the ! */ } + + if (geoipdata->nlocations >= GEOOPTION_MAXLOCATIONS) { + SCLogError(SC_ERR_INVALID_ARGUMENT, "too many arguements for geoip keyword"); + goto error; + } + if (pos-prevpos > GEOOPTION_MAXSIZE) strlcpy((char *)geoipdata->location[geoipdata->nlocations], &str[prevpos], GEOOPTION_MAXSIZE);