diff --git a/src/util-detect-file-hash.c b/src/util-detect-file-hash.c index 2cd884975f..840f61c2bb 100644 --- a/src/util-detect-file-hash.c +++ b/src/util-detect-file-hash.c @@ -193,6 +193,8 @@ int DetectFileHashMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, SCReturnInt(ret); } +static const char *hexcodes = "ABCDEFabcdef0123456789"; + /** * \brief Parse the filemd5, filesha1 or filesha256 keyword * @@ -251,24 +253,17 @@ static DetectFileHashData *DetectFileHashParse (const DetectEngineCtx *de_ctx, int line_no = 0; while(fgets(line, (int)sizeof(line), fp) != NULL) { - size_t len = strlen(line); + size_t valid = 0, len = strlen(line); line_no++; - /* ignore comments and empty lines */ - if (line[0] == '\n' || line [0] == '\r' || line[0] == ' ' || line[0] == '#' || line[0] == '\t') - continue; - - while (isspace(line[--len])); + while (strchr(hexcodes, line[valid]) != NULL && valid++ < len); - /* Check if we have a trailing newline, and remove it */ - len = strlen(line); - if (len > 0 && (line[len - 1] == '\n' || line[len - 1] == '\r')) { - line[len - 1] = '\0'; - } + /* lines that do not contain sequentially any valid character are ignored */ + if (valid == 0) + continue; - /* cut off longer lines than a SHA256 represented in hexadecimal */ - if (strlen(line) > 64) - line[64] = 0x00; + /* ignore anything after the sequence of valid characters */ + line[valid] = '\0'; if (LoadHashTable(filehash->hash, line, filename, line_no, type) != 1) { goto error;