From 4bfd385cb5871bc0619702ca54a7e13d457f7694 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 23 Jul 2026 09:15:08 +0200 Subject: [PATCH] detect/transform: limit json_decode to start of buffer --- doc/userguide/rules/transforms.rst | 4 ++++ rust/src/detect/transforms/json.rs | 5 +++++ 2 files changed, 9 insertions(+) diff --git a/doc/userguide/rules/transforms.rst b/doc/userguide/rules/transforms.rst index 558d27d208..56def53b1f 100644 --- a/doc/userguide/rules/transforms.rst +++ b/doc/userguide/rules/transforms.rst @@ -201,6 +201,10 @@ As such, an escaped double quote in a string will not be replaced and will remai Invalid json such as an unescaped tabulation in a string will not be escaped. Single unpaired UTF-16 surrogate get unescaped. +This transform only works if we have the buffer from its beginning +because we need to know which state we are in to start the parsing. +That means we can only json_decode the first 32KiB of one ``file.data``. + xor --- diff --git a/rust/src/detect/transforms/json.rs b/rust/src/detect/transforms/json.rs index 76ccfc3039..e495692fe4 100644 --- a/rust/src/detect/transforms/json.rs +++ b/rust/src/detect/transforms/json.rs @@ -301,6 +301,11 @@ unsafe extern "C" fn json_decode_transform( if input.is_null() || input_len == 0 { return; } + if (*buffer).inspect_offset > 0 { + // Only apply json_decode transform if we are at the beginning of the buffer. + // Otherwise, we do not know in which state to start + return; + } let input = build_slice!(input, input_len as usize); let output = SCInspectionBufferCheckAndExpand(buffer, input_len);