From 0e7cb90212e9c673cc02c7d5b7c35fba2ac6bc5c Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 18 Mar 2010 22:08:37 +0100 Subject: [PATCH] Fix broken pmatch list handling. --- src/detect-parse.c | 33 ++++++++++++++++++++++++++++++++- 1 file changed, 32 insertions(+), 1 deletion(-) diff --git a/src/detect-parse.c b/src/detect-parse.c index d37ba9dec5..b5769296d6 100644 --- a/src/detect-parse.c +++ b/src/detect-parse.c @@ -109,6 +109,7 @@ void SigMatchAppendPayload(Signature *s, SigMatch *new) { s->pmatch = new; s->pmatch_tail = new; new->next = NULL; + new->prev = NULL; } else { SigMatch *cur = s->pmatch; @@ -131,6 +132,7 @@ void SigMatchAppendPacket(Signature *s, SigMatch *new) { s->match = new; s->match_tail = new; new->next = NULL; + new->prev = NULL; } else { SigMatch *cur = s->match; @@ -169,9 +171,14 @@ void SigMatchReplaceContent(Signature *s, SigMatch *old, SigMatch *new) { } if (m == s->pmatch_tail) { - s->pmatch_tail = pm; + if (pm == m) { + s->pmatch_tail = NULL; + } else { + s->pmatch_tail = pm; + } } + //printf("m %p s->pmatch %p s->pmatch_tail %p\n", m, s->pmatch, s->pmatch_tail); break; } @@ -1091,6 +1098,28 @@ end: return result; } +/** \test Parsing bug debugging at 2010-03-18 */ +int SigParseTest06 (void) { + int result = 0; + Signature *sig = NULL; + + DetectEngineCtx *de_ctx = DetectEngineCtxInit(); + if (de_ctx == NULL) + goto end; + + sig = SigInit(de_ctx, "alert tcp any any -> any any (flow:to_server; content:\"GET\"; nocase; http_method; uricontent:\"/uri/\"; nocase; content:\"Host|3A| abc\"; nocase; sid:1; rev:1;)"); + if (sig != NULL) { + result = 1; + } else { + printf("signature failed to parse: "); + } + +end: + if (sig != NULL) SigFree(sig); + if (de_ctx != NULL) DetectEngineCtxFree(de_ctx); + return result; +} + /** \test Direction operator validation (invalid) */ int SigParseBidirecTest06 (void) { int result = 1; @@ -1949,6 +1978,8 @@ void SigParseRegisterTests(void) { UtRegisterTest("SigParseTest03", SigParseTest03, 1); UtRegisterTest("SigParseTest04", SigParseTest04, 1); UtRegisterTest("SigParseTest05", SigParseTest05, 1); + UtRegisterTest("SigParseTest06", SigParseTest06, 1); + UtRegisterTest("SigParseBidirecTest06", SigParseBidirecTest06, 1); UtRegisterTest("SigParseBidirecTest07", SigParseBidirecTest07, 1); UtRegisterTest("SigParseBidirecTest08", SigParseBidirecTest08, 1);