From 031cc11679be17f459f973bb3fd7678be23bf8d9 Mon Sep 17 00:00:00 2001 From: Jeff Lucovsky Date: Wed, 21 Oct 2026 08:43:58 -0400 Subject: [PATCH] detect/content-inspection: assert smd is set DetectEngineContentInspectionInternal checked smd for NULL only after the recursion-limit return had read smd->type, and its NULL branch read smd->type too. No caller passes NULL: engines without a keyword list have no callback, empty sticky buffers fail to load, payload engines exist only with payload keywords, and the recursion stops at the last keyword. Drop smd from the NULL check and assert it with DEBUG_VALIDATE_BUG_ON. --- src/detect-engine-content-inspection.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c index 876131e013..36e911e1bc 100644 --- a/src/detect-engine-content-inspection.c +++ b/src/detect-engine-content-inspection.c @@ -110,6 +110,9 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx, const enum DetectContentInspectionType inspection_mode) { SCEnter(); + // every caller passes a keyword list, and the recursion below stops at + // its last entry; the profiling calls rely on that to read smd->type + DEBUG_VALIDATE_BUG_ON(smd == NULL); KEYWORD_PROFILING_START; ctx->recursion.count++; @@ -119,7 +122,7 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx, } // we want the ability to match on bsize: 0 - if (smd == NULL || buffer == NULL) { + if (buffer == NULL) { KEYWORD_PROFILING_END(det_ctx, smd->type, 0); SCReturnInt(0); }