From 59358d696724a176b97153ea0ffb584bc83ac51c Mon Sep 17 00:00:00 2001
From: Lukas Sismis <lsismis@oisf.net>
Date: Fri, 14 Aug 2026 13:12:49 +0200
Subject: [PATCH] lua: validate signature argument to bytevar.map

bytevar.map() read its first argument as a Signature pointer.
Dereferencing the full userdata stopped the engine at rule load.
The commit provides a more intuitive user message when the user
provides full user data.
---
 src/util-lua-bytevarlib.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/util-lua-bytevarlib.c b/src/util-lua-bytevarlib.c
index 8564f94667..c662789ec7 100644
--- a/src/util-lua-bytevarlib.c
+++ b/src/util-lua-bytevarlib.c
@@ -38,6 +38,9 @@ static DetectLuaData *GetLuaData(lua_State *luastate)
 
 static int LuaBytevarMap(lua_State *L)
 {
+    if (!lua_islightuserdata(L, -2)) {
+        return luaL_error(L, "bytevar.map: first argument must be the signature passed to init");
+    }
     const Signature *s = lua_touserdata(L, -2);
     const char *name = luaL_checkstring(L, -1);
     DetectLuaData *ld = GetLuaData(L);