warn users that we don't support content strings whose length's > 255.

src/detect-content.c

@@ -222,6 +222,13 @@ DetectContentData *DetectContentParse (char *contentstr)
     if (ret == -1) {
         return NULL;
     }
+    if (len > 255) {
+        SCLogError(SC_ERR_NOT_SUPPORTED, "Currently we don't support content "
+                   "length greater than 255.  Please split the pattern, if "
+                   "length > 255.  The length of the content after "
+                   "normalization is \"%"PRIu16"\".", len);
+        return NULL;
+    }
 
     cd = SCMalloc(sizeof(DetectContentData) + len);
     if (unlikely(cd == NULL)) {
@@ -2066,6 +2073,122 @@ end:
     return result;
 }
 
+int DetectContentParseTest41(void)
+{
+    int result = 1;
+    DetectContentData *cd = NULL;
+    int patlen = 257;
+    char *teststring = SCMalloc(sizeof(char) * (patlen + 1));
+    if (teststring == NULL)
+        return 0;
+    int idx = 0;
+    teststring[idx++] = '\"';
+    for (int i = 0; i < (patlen - 2); idx++, i++) {
+        teststring[idx] = 'a';
+    }
+    teststring[idx++] = '\"';
+    teststring[idx++] = '\0';
+
+    cd = DetectContentParse(teststring);
+    if (cd == NULL) {
+        SCLogDebug("expected not NULL");
+        result = 0;
+    }
+
+    SCFree(teststring);
+    DetectContentFree(cd);
+    return result;
+}
+
+int DetectContentParseTest42(void)
+{
+    int result = 1;
+    DetectContentData *cd = NULL;
+    int patlen = 258;
+    char *teststring = SCMalloc(sizeof(char) * (patlen + 1));
+    if (teststring == NULL)
+        return 0;
+    int idx = 0;
+    teststring[idx++] = '\"';
+    for (int i = 0; i < (patlen - 2); idx++, i++) {
+        teststring[idx] = 'a';
+    }
+    teststring[idx++] = '\"';
+    teststring[idx++] = '\0';
+
+    cd = DetectContentParse(teststring);
+    if (cd != NULL) {
+        SCLogDebug("expected NULL got %p: ", cd);
+        result = 0;
+    }
+
+    SCFree(teststring);
+    DetectContentFree(cd);
+    return result;
+}
+
+int DetectContentParseTest43(void)
+{
+    int result = 1;
+    DetectContentData *cd = NULL;
+    int patlen = 260;
+    char *teststring = SCMalloc(sizeof(char) * (patlen + 1));
+    if (teststring == NULL)
+        return 0;
+    int idx = 0;
+    teststring[idx++] = '\"';
+    teststring[idx++] = '|';
+    teststring[idx++] = '4';
+    teststring[idx++] = '6';
+    teststring[idx++] = '|';
+    for (int i = 0; i < (patlen - 6); idx++, i++) {
+        teststring[idx] = 'a';
+    }
+    teststring[idx++] = '\"';
+    teststring[idx++] = '\0';
+
+    cd = DetectContentParse(teststring);
+    if (cd == NULL) {
+        SCLogDebug("expected not NULL");
+        result = 0;
+    }
+
+    SCFree(teststring);
+    DetectContentFree(cd);
+    return result;
+}
+
+int DetectContentParseTest44(void)
+{
+    int result = 1;
+    DetectContentData *cd = NULL;
+    int patlen = 261;
+    char *teststring = SCMalloc(sizeof(char) * (patlen + 1));
+    if (teststring == NULL)
+        return 0;
+    int idx = 0;
+    teststring[idx++] = '\"';
+    teststring[idx++] = '|';
+    teststring[idx++] = '4';
+    teststring[idx++] = '6';
+    teststring[idx++] = '|';
+    for (int i = 0; i < (patlen - 6); idx++, i++) {
+        teststring[idx] = 'a';
+    }
+    teststring[idx++] = '\"';
+    teststring[idx++] = '\0';
+
+    cd = DetectContentParse(teststring);
+    if (cd != NULL) {
+        SCLogDebug("expected NULL got %p: ", cd);
+        result = 0;
+    }
+
+    SCFree(teststring);
+    DetectContentFree(cd);
+    return result;
+}
+
 static int SigTestNegativeTestContent(char *rule, uint8_t *buf)
 {
     uint16_t buflen = strlen((char *)buf);
@@ -2490,6 +2613,10 @@ void DetectContentRegisterTests(void)
     UtRegisterTest("DetectContentParseTest38", DetectContentParseTest38, 1);
     UtRegisterTest("DetectContentParseTest39", DetectContentParseTest39, 1);
     UtRegisterTest("DetectContentParseTest40", DetectContentParseTest40, 1);
+    UtRegisterTest("DetectContentParseTest41", DetectContentParseTest41, 1);
+    UtRegisterTest("DetectContentParseTest42", DetectContentParseTest42, 1);
+    UtRegisterTest("DetectContentParseTest43", DetectContentParseTest43, 1);
+    UtRegisterTest("DetectContentParseTest44", DetectContentParseTest44, 1);
 
     /* The reals */
     UtRegisterTest("DetectContentLongPatternMatchTest01", DetectContentLongPatternMatchTest01, 1);

src/util-error.c

@@ -240,6 +240,7 @@ const char * SCErrorToString(SCError err)
         CASE_CODE (SC_ERR_LUAJIT_ERROR);
         CASE_CODE (SC_ERR_DEFRAG_INIT);
         CASE_CODE (SC_ERR_NO_REPUTATION);
+        CASE_CODE (SC_ERR_NOT_SUPPORTED);
         default:
             return "UNKNOWN_ERROR";
     }

src/util-error.h

@@ -254,6 +254,7 @@ typedef enum {
     SC_ERR_NAPATECH_STAT_DROPS_FAILED,
     SC_ERR_NAPATECH_PARSE_CONFIG,
     SC_ERR_NO_REPUTATION,
+    SC_ERR_NOT_SUPPORTED,
 } SCError;
 
 const char *SCErrorToString(SCError);