detect/parse: set limits for pcre2

Ticket: 6889

To avoid regexp dos with too much backtracking.
This is already done on pcre keyword, and pcrexform transform.
We use the same default limits for rules parsing.

(cherry picked from commit 316cc528f7)

Using pcre1 in master6
pull/10945/head
Philippe Antoine 3 years ago committed by Victor Julien
parent d5ffecf11a
commit 1099eec3dd

@ -2497,7 +2497,14 @@ bool DetectSetupParseRegexesOpts(const char *parse_str, DetectParseRegex *detect
SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
return false;
}
if (detect_parse->study != NULL) {
detect_parse->study->match_limit = SC_MATCH_LIMIT_DEFAULT;
detect_parse->study->flags |= PCRE_EXTRA_MATCH_LIMIT;
#ifndef NO_PCRE_MATCH_RLIMIT
detect_parse->study->match_limit_recursion = SC_MATCH_LIMIT_RECURSION_DEFAULT;
detect_parse->study->flags |= PCRE_EXTRA_MATCH_LIMIT_RECURSION;
#endif /* NO_PCRE_MATCH_RLIMIT */
}
DetectParseRegexAddToFreeList(detect_parse);

Loading…
Cancel
Save