From 21bcbe14c16e757e93b3f2482099093e8d25e095 Mon Sep 17 00:00:00 2001
From: Denis Balashov <balasovdenis74@gmail.com>
Date: Thu, 4 Jun 2026 12:30:53 +0300
Subject: [PATCH] detect/alert: guard SCStrdup result before use

SCStrdup result was stored and immediately used without checking for
NULL, which would cause a NULL dereference if allocation fails.
---
 src/detect-engine-alert.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 5bf150115f..eb5373d591 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -360,6 +360,9 @@ static inline int PacketAlertSetContext(
                     }
                 }
                 current_json->json_string = SCStrdup(det_ctx->json_content[i].json_content);
+                if (current_json->json_string == NULL) {
+                    return -1;
+                }
                 SCLogDebug("json content %u, value '%s' (%p)", (unsigned int)i,
                         current_json->json_string, s);
             }