fix for bug 113

src/detect-content.c

@@ -1123,6 +1123,33 @@ int DetectContentParseNegTest16(void) {
     return result;
 }
 
+/**
+ * \test Test cases where if within specified is < content lenggth we invalidate
+ *       the sig.
+ */
+int DetectContentParseTest17(void)
+{
+    int result = 0;
+    char *sigstr = "alert tcp any any -> any any (msg:\"Dummy\"; "
+        "content:one; content:two; within:2; sid:1;)";
+
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    if (de_ctx == NULL)
+        goto end;
+
+    de_ctx->sig_list = SigInit(de_ctx, sigstr);
+    if (de_ctx->sig_list != NULL)
+        goto end;
+
+    result = 1;
+
+end:
+    SigCleanSignatures(de_ctx);
+    if (de_ctx != NULL)
+        DetectEngineCtxFree(de_ctx);
+    return result;
+}
+
 static int SigTestPositiveTestContent(char *rule, uint8_t *buf)
 {
     uint16_t buflen = strlen((char *)buf);
@@ -1515,6 +1542,7 @@ void DetectContentRegisterTests(void)
     UtRegisterTest("DetectContentParseTest14", DetectContentParseNegTest14, 1);
     UtRegisterTest("DetectContentParseTest15", DetectContentParseNegTest15, 1);
     UtRegisterTest("DetectContentParseTest16", DetectContentParseNegTest16, 1);
+    UtRegisterTest("DetectContentParseTest17", DetectContentParseTest17, 1);
 
     /* The reals */
     UtRegisterTest("DetectContentLongPatternMatchTest01", DetectContentLongPatternMatchTest01, 1);

src/detect-engine.c

@@ -488,6 +488,11 @@ TmEcode DetectEngineThreadCtxInit(ThreadVars *tv, void *initdata, void **data) {
 TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data) {
     DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
 
+    if (det_ctx == NULL) {
+        SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "argument \"data\" NULL");
+        return TM_ECODE_OK;
+    }
+
     DetectEngineIPOnlyThreadDeinit(&det_ctx->io_ctx);
 
     /** \todo get rid of this static */

src/detect-within.c

@@ -60,6 +60,12 @@ static int DetectWithinSetup (DetectEngineCtx *de_ctx, Signature *s, char *withi
     }
 
     cd->within = strtol(str, NULL, 10);
+    if (cd->within < cd->content_len) {
+        SCLogError(SC_ERR_INVALID_SIGNATURE, "within argument \"%d\" is less "
+                   "than the content length \"%s\" which is invalid, since this "
+                   "will never match.  Invalidating signature", cd->within, cd->content);
+        goto error;
+    }
     cd->flags |= DETECT_CONTENT_WITHIN;
 
     if (cd->flags & DETECT_CONTENT_DISTANCE) {

src/detect.c

@@ -8020,7 +8020,7 @@ static int SigTestContent04Wm (void) {
 
 /** \test sigs with patterns at the limit of the pm's size limit */
 static int SigTestContent05Real (int mpm_type) {
-    uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
+    uint8_t *buf = (uint8_t *)"01234567890123456789012345678901PADabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
     uint16_t buflen = strlen((char *)buf);
     Packet p;
     ThreadVars th_v;
@@ -8044,12 +8044,12 @@ static int SigTestContent05Real (int mpm_type) {
     de_ctx->mpm_matcher = mpm_type;
     de_ctx->flags |= DE_QUIET;
 
-    de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:31; sid:1;)");
+    de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)");
     if (de_ctx->sig_list == NULL) {
         printf("sig1 parse failed: ");
         goto end;
     }
-    de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:1; within:33; sid:2;)");
+    de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:1; within:32; sid:2;)");
     if (de_ctx->sig_list->next == NULL) {
         printf("sig2 parse failed: ");
         goto end;