aiden
/
suricata
mirror of https://github.com/OISF/suricata
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

detect: fix buffer length to uint32

Browse Source 
There is a difference in the size of the buffer length as passed from
the content buffers (cfr HttpReassembledBody.buffer_len) and the buflen
variable passed to mpm primitives. This can cause a misdetection
whenever the bufferlen is multiple of 65536 (as uint16(X*65536) == 0).
Increasing the buflen variable type to uint32 solves the issue (this
does not cause any issue with primitives, they all accept uint32).
pull/3352/head
Maurizio Abba 8 years ago committed by Victor Julien
parent 2e8fd612a6
commit d2bf7a3ba9
12 changed files with 67 additions and 61 deletions
Show Stats Download Patch File Download Diff File

6
src/util-mpm-ac-bs.c
Unescape Escape View File

@ -70,7 +70,7 @@ int SCACBSAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t,
uint32_t, SigIntId, uint8_t);
int SCACBSPreparePatterns(MpmCtx *mpm_ctx);
uint32_t SCACBSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen);
PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen);
void SCACBSPrintInfo(MpmCtx *mpm_ctx);
void SCACBSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx);
void SCACBSRegisterTests(void);
@ -1143,10 +1143,10 @@ void SCACBSDestroyCtx(MpmCtx *mpm_ctx)
* \retval matches Match count.
*/
uint32_t SCACBSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen)
PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen)
{
const SCACBSCtx *ctx = (SCACBSCtx *)mpm_ctx->ctx;
int i = 0;
uint32_t i = 0;
int matches = 0;
uint8_t buf_local;

4
src/util-mpm-ac-tile-small.c
Unescape Escape View File

@ -32,9 +32,9 @@
/* This function handles (ctx->state_count < 32767) */
uint32_t FUNC_NAME(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen)
PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen)
{
int i = 0;
uint32_t i = 0;
int matches = 0;
uint8_t mpm_bitarray[ctx->mpm_bitarray_size];

36
src/util-mpm-ac-tile.c
Unescape Escape View File

@ -93,51 +93,51 @@ int SCACTileAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t,
int SCACTilePreparePatterns(MpmCtx *mpm_ctx);
uint32_t SCACTileSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf,
uint16_t buflen);
uint32_t buflen);
void SCACTilePrintInfo(MpmCtx *mpm_ctx);
void SCACTilePrintSearchStats(MpmThreadCtx *mpm_thread_ctx);
void SCACTileRegisterTests(void);
uint32_t SCACTileSearchLarge(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchSmall256(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchSmall128(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchSmall64(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchSmall32(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchSmall16(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchSmall8(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchTiny256(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchTiny128(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchTiny64(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchTiny32(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchTiny16(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
uint32_t SCACTileSearchTiny8(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen);
const uint8_t *buf, uint32_t buflen);
static void SCACTileDestroyInitCtx(MpmCtx *mpm_ctx);
@ -1175,7 +1175,7 @@ void SCACTileDestroyCtx(MpmCtx *mpm_ctx)
#endif
static int CheckMatch(const SCACTileSearchCtx *ctx, PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen,
const uint8_t *buf, uint32_t buflen,
uint16_t state, int i, int matches,
uint8_t *mpm_bitarray)
{
@ -1242,7 +1242,7 @@ static int CheckMatch(const SCACTileSearchCtx *ctx, PrefilterRuleStore *pmq,
* \retval matches Match count.
*/
uint32_t SCACTileSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen)
PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen)
{
const SCACTileSearchCtx *search_ctx = (SCACTileSearchCtx *)mpm_ctx->ctx;
@ -1256,9 +1256,9 @@ uint32_t SCACTileSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
/* This function handles (ctx->state_count >= 32767) */
uint32_t SCACTileSearchLarge(const SCACTileSearchCtx *ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq,
const uint8_t *buf, uint16_t buflen)
const uint8_t *buf, uint32_t buflen)
{
int i = 0;
uint32_t i = 0;
int matches = 0;
uint8_t mpm_bitarray[ctx->mpm_bitarray_size];

4
src/util-mpm-ac-tile.h
Unescape Escape View File

@ -67,7 +67,7 @@ typedef struct SCACTileCtx_ {
* 32 bits.
*/
uint32_t (*Search)(const struct SCACTileSearchCtx_ *ctx, struct MpmThreadCtx_ *,
PrefilterRuleStore *, const uint8_t *, uint16_t);
PrefilterRuleStore *, const uint8_t *, uint32_t);
/* Function to set the next state based on size of next state
* (bytes_per_state).
@ -120,7 +120,7 @@ typedef struct SCACTileSearchCtx_ {
* 32 bits.
*/
uint32_t (*Search)(const struct SCACTileSearchCtx_ *ctx, struct MpmThreadCtx_ *,
PrefilterRuleStore *, const uint8_t *, uint16_t);
PrefilterRuleStore *, const uint8_t *, uint32_t);
/* Convert input character to matching alphabet */
uint8_t translate_table[256];

6
src/util-mpm-ac.c
Unescape Escape View File

@ -70,7 +70,7 @@ int SCACAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t,
uint32_t, SigIntId, uint8_t);
int SCACPreparePatterns(MpmCtx *mpm_ctx);
uint32_t SCACSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen);
PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen);
void SCACPrintInfo(MpmCtx *mpm_ctx);
void SCACPrintSearchStats(MpmThreadCtx *mpm_thread_ctx);
void SCACRegisterTests(void);
@ -1027,10 +1027,10 @@ void SCACDestroyCtx(MpmCtx *mpm_ctx)
* \retval matches Match count.
*/
uint32_t SCACSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, uint16_t buflen)
PrefilterRuleStore *pmq, const uint8_t *buf, uint32_t buflen)
{
const SCACCtx *ctx = (SCACCtx *)mpm_ctx->ctx;
int i = 0;
uint32_t i = 0;
int matches = 0;
/* \todo tried loop unrolling with register var, with no perf increase. Need

4
src/util-mpm-hs.c
Unescape Escape View File

@ -56,7 +56,7 @@ int SCHSAddPatternCS(MpmCtx *, uint8_t *, uint16_t, uint16_t, uint16_t,
uint32_t, SigIntId, uint8_t);
int SCHSPreparePatterns(MpmCtx *mpm_ctx);
uint32_t SCHSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, const uint16_t buflen);
PrefilterRuleStore *pmq, const uint8_t *buf, const uint32_t buflen);
void SCHSPrintInfo(MpmCtx *mpm_ctx);
void SCHSPrintSearchStats(MpmThreadCtx *mpm_thread_ctx);
void SCHSRegisterTests(void);
@ -917,7 +917,7 @@ static int SCHSMatchEvent(unsigned int id, unsigned long long from,
* \retval matches Match count.
*/
uint32_t SCHSSearch(const MpmCtx *mpm_ctx, MpmThreadCtx *mpm_thread_ctx,
PrefilterRuleStore *pmq, const uint8_t *buf, const uint16_t buflen)
PrefilterRuleStore *pmq, const uint8_t *buf, const uint32_t buflen)
{
uint32_t ret = 0;
SCHSCtx *ctx = (SCHSCtx *)mpm_ctx->ctx;

2
src/util-mpm.h
Unescape Escape View File

@ -155,7 +155,7 @@ typedef struct MpmTableElmt_ {
int (*AddPattern)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
int (*AddPatternNocase)(struct MpmCtx_ *, uint8_t *, uint16_t, uint16_t, uint16_t, uint32_t, SigIntId, uint8_t);
int (*Prepare)(struct MpmCtx_ *);
uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint16_t);
uint32_t (*Search)(const struct MpmCtx_ *, struct MpmThreadCtx_ *, PrefilterRuleStore *, const uint8_t *, uint32_t);
void (*PrintCtx)(struct MpmCtx_ *);
void (*PrintThreadCtx)(struct MpmThreadCtx_ *);
void (*RegisterUnittests)(void);

22
src/util-spm-bm.c
Unescape Escape View File

@ -303,12 +303,13 @@ static void PreBmGsNocase(const uint8_t *x, uint16_t m, uint16_t *bmGs)
*
* \retval ptr to start of the match; NULL if no match
*/
uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx)
uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, uint32_t n, BmCtx *bm_ctx)
{
uint16_t *bmGs = bm_ctx->bmGs;
uint16_t *bmBc = bm_ctx->bmBc;
int i, j, m1, m2;
int32_t int_n;
#if 0
printf("\nBad:\n");
for (i=0;i<ALPHABET_SIZE;i++)
@ -319,16 +320,17 @@ uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, B
printf("%c, %d ", x[i],bmBc[i]);
printf("\n");
#endif
// force casting to int32_t (if possible)
int_n = unlikely(n > INT32_MAX) ? INT32_MAX : n;
j = 0;
while (j <= n - m ) {
while (j <= int_n - m ) {
for (i = m - 1; i >= 0 && x[i] == y[i + j]; --i);
if (i < 0) {
return (uint8_t *)(y + j);
//j += bmGs[0];
} else {
// printf("%c", y[i+j]);
// printf("%c", y[i+j]);
j += (m1 = bmGs[i]) > (m2 = bmBc[y[i + j]] - m + 1 + i)? m1: m2;
// printf("%d, %d\n", m1, m2);
}
@ -352,11 +354,12 @@ uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, B
*
* \retval ptr to start of the match; NULL if no match
*/
uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx)
uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, uint32_t n, BmCtx *bm_ctx)
{
uint16_t *bmGs = bm_ctx->bmGs;
uint16_t *bmBc = bm_ctx->bmBc;
int i, j, m1, m2;
int32_t int_n;
#if 0
printf("\nBad:\n");
for (i=0;i<ALPHABET_SIZE;i++)
@ -367,15 +370,18 @@ uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, int32_
printf("%c, %d ", x[i],bmBc[i]);
printf("\n");
#endif
// force casting to int32_t (if possible)
int_n = unlikely(n > INT32_MAX) ? INT32_MAX : n;
j = 0;
while (j <= n - m ) {
while (j <= int_n - m ) {
/* x is stored in lowercase. */
for (i = m - 1; i >= 0 && x[i] == u8_tolower(y[i + j]); --i);
if (i < 0) {
return (uint8_t *)(y + j);
} else {
j += (m1=bmGs[i]) > (m2=bmBc[u8_tolower(y[i + j])] - m + 1 + i)?m1:m2;
j += (m1 = bmGs[i]) > (m2 = bmBc[u8_tolower(y[i + j])] - m + 1 + i)?
m1: m2;
}
}
return NULL;
@ -448,7 +454,7 @@ static void BMDestroyCtx(SpmCtx *ctx)
}
static uint8_t *BMScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx,
const uint8_t *haystack, uint16_t haystack_len)
const uint8_t *haystack, uint32_t haystack_len)
{
const SpmBmCtx *sctx = ctx->ctx;

4
src/util-spm-bm.h
Unescape Escape View File

@ -41,8 +41,8 @@ BmCtx *BoyerMooreCtxInit(const uint8_t *needle, uint16_t needle_len);
BmCtx *BoyerMooreNocaseCtxInit(uint8_t *needle, uint16_t needle_len);
void BoyerMooreCtxToNocase(BmCtx *, uint8_t *, uint16_t);
uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx);
uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, int32_t n, BmCtx *bm_ctx);
uint8_t *BoyerMoore(const uint8_t *x, uint16_t m, const uint8_t *y, uint32_t n, BmCtx *bm_ctx);
uint8_t *BoyerMooreNocase(const uint8_t *x, uint16_t m, const uint8_t *y, uint32_t n, BmCtx *bm_ctx);
void BoyerMooreCtxDeInit(BmCtx *);
void SpmBMRegister(void);

2
src/util-spm-hs.c
Unescape Escape View File

@ -136,7 +136,7 @@ static SpmCtx *HSInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase,
}
static uint8_t *HSScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx,
const uint8_t *haystack, uint16_t haystack_len)
const uint8_t *haystack, uint32_t haystack_len)
{
const SpmHsCtx *sctx = ctx->ctx;
hs_scratch_t *scratch = thread_ctx->ctx;

2
src/util-spm.c
Unescape Escape View File

@ -184,7 +184,7 @@ void SpmDestroyCtx(SpmCtx *ctx)
}
uint8_t *SpmScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx,
const uint8_t *haystack, uint16_t haystack_len)
const uint8_t *haystack, uint32_t haystack_len)
{
uint16_t matcher = ctx->matcher;
return spm_table[matcher].Scan(ctx, thread_ctx, haystack, haystack_len);

4
src/util-spm.h
Unescape Escape View File

@ -68,7 +68,7 @@ typedef struct SpmTableElmt_ {
SpmGlobalThreadCtx *g_thread_ctx);
void (*DestroyCtx)(SpmCtx *);
uint8_t *(*Scan)(const SpmCtx *ctx, SpmThreadCtx *thread_ctx,
const uint8_t *haystack, uint16_t haystack_len);
const uint8_t *haystack, uint32_t haystack_len);
} SpmTableElmt;
SpmTableElmt spm_table[SPM_TABLE_SIZE];
@ -89,7 +89,7 @@ SpmCtx *SpmInitCtx(const uint8_t *needle, uint16_t needle_len, int nocase,
void SpmDestroyCtx(SpmCtx *ctx);
uint8_t *SpmScan(const SpmCtx *ctx, SpmThreadCtx *thread_ctx,
const uint8_t *haystack, uint16_t haystack_len);
const uint8_t *haystack, uint32_t haystack_len);
/** Default algorithm to use: Boyer Moore */
uint8_t *Bs2bmSearch(const uint8_t *text, uint32_t textlen, const uint8_t *needle, uint16_t needlelen);

Write Preview
Loading…
Cancel
Save