From c935f08cd988600fd0a4f828a585b181dd5de012 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Sun, 28 Sep 2025 21:55:44 +0200 Subject: [PATCH] detect: fix null deref with entropy keyword Ticket: 7959 Usage of entropy with base64_data led to NULL dereference (cherry picked from commit 6d703af505ddf3c2a98eaff24cb1461dbf1ae1a2) --- src/detect-entropy.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/detect-entropy.c b/src/detect-entropy.c index 13dcd725d5..4ef97b7e94 100644 --- a/src/detect-entropy.c +++ b/src/detect-entropy.c @@ -42,8 +42,17 @@ static int DetectEntropySetup(DetectEngineCtx *de_ctx, Signature *s, const char goto error; sm_list = s->init_data->list; - ded->fv_idx = VarNameStoreRegister( - DetectEngineBufferTypeGetNameById(de_ctx, sm_list), VAR_TYPE_FLOW_FLOAT); + const char *name; + if (sm_list == DETECT_SM_LIST_BASE64_DATA) { + name = "base64_data"; + } else { + name = DetectEngineBufferTypeGetNameById(de_ctx, sm_list); + if (name == NULL) { + DEBUG_VALIDATE_BUG_ON(1); + name = "unknown"; + } + } + ded->fv_idx = VarNameStoreRegister(name, VAR_TYPE_FLOW_FLOAT); } else { ded->fv_idx = VarNameStoreRegister("content", VAR_TYPE_FLOW_FLOAT); }