diff --git a/src/detect-msg.c b/src/detect-msg.c index d782bb887e..2dbcd5dc5d 100644 --- a/src/detect-msg.c +++ b/src/detect-msg.c @@ -16,6 +16,10 @@ void DetectMsgRegister (void) { int DetectMsgSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *msgstr) { char *str = NULL; + uint16_t len; + + if (strlen(msgstr) == 0) + goto error; /* strip "'s */ if (msgstr[0] == '\"' && msgstr[strlen(msgstr)-1] == '\"') { @@ -28,12 +32,61 @@ int DetectMsgSetup (DetectEngineCtx *de_ctx, Signature *s, SigMatch *m, char *ms //printf("DetectMsgSetup: format hack applied: \'%s\'\n", str); } else { printf("DetectMsgSetup: format error \'%s\'\n", msgstr); - return -1; + goto error; + } + + len = strlen(str); + if (len == 0) + goto error; + + char converted = 0; + + { + uint16_t i, x; + uint8_t escape = 0; + + for (i = 0, x = 0; i < len; i++) { + //printf("str[%02u]: %c\n", i, str[i]); + if(!escape && str[i] == '\\') { + escape = 1; + } else if (escape) { + if (str[i] == ':' || + str[i] == ';' || + str[i] == '\\' || + str[i] == '\"') + { + str[x] = str[i]; + x++; + } else { + printf("Can't escape %c\n", str[i]); + goto error; + } + + escape = 0; + converted = 1; + } else { + str[x] = str[i]; + x++; + } + } +#ifdef DEBUG + for (i = 0; i < x; i++) { + printf("%c", str[i]); + } + printf("\n"); +#endif + + if (converted) { + len = x; + } } s->msg = strdup(str); free(str); return 0; -} +error: + free(str); + return -1; +}