From e0c36f7affb8fc5aff057397fbd5512d1391f4ea Mon Sep 17 00:00:00 2001 From: Anoop Saldanha Date: Mon, 31 Oct 2011 22:06:59 +0530 Subject: [PATCH] fix dsize sigs handling. We can't use more than 2 dsizes in the same sig --- src/detect-dsize.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/src/detect-dsize.c b/src/detect-dsize.c index 6554093712..7022500054 100644 --- a/src/detect-dsize.c +++ b/src/detect-dsize.c @@ -275,6 +275,13 @@ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr DetectDsizeData *dd = NULL; SigMatch *sm = NULL; + if (SigMatchGetLastSM(s->sm_lists_tail[DETECT_SM_LIST_MATCH], + DETECT_DSIZE) != NULL) { + SCLogError(SC_ERR_INVALID_SIGNATURE, "Can't use 2 or more dsizes in " + "the same sig. Invalidating signature."); + goto error; + } + SCLogDebug("\'%s\'", rawstr); dd = DetectDsizeParse(rawstr); @@ -288,6 +295,7 @@ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr sm = SigMatchAlloc(); if (sm == NULL){ SCLogError(SC_ERR_MEM_ALLOC, "Failed to allocate memory for SigMatch"); + SCFree(dd); goto error; } @@ -304,8 +312,6 @@ static int DetectDsizeSetup (DetectEngineCtx *de_ctx, Signature *s, char *rawstr return 0; error: - if (dd) SCFree(dd); - if (sm) SCFree(sm); return -1; }