From 2cb8ba5becef2cf856a7fe75ffdebb4b78fe6b59 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 5 Mar 2026 10:23:10 +0100
Subject: [PATCH] output: debug validation before stack allocation

A rule size has a global bound, which bounds the references
parsed in it.

Ticket: 8001
---
 src/output-json-alert.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index 933dfd5e66..65f6f9645d 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -185,6 +185,7 @@ static void AlertJsonReference(const PacketAlert *pa, SCJsonBuilder *jb)
          * add +2 to safisfy gcc 15 + -Wformat-truncation=2
          */
         const size_t size_needed = kv->key_len + kv->reference_len + 3;
+        DEBUG_VALIDATE_BUG_ON(size_needed > DETECT_MAX_RULE_SIZE);
         char kv_store[size_needed];
         snprintf(kv_store, size_needed, "%s%s", kv->key, kv->reference);
         SCJbAppendString(jb, kv_store);