detect: fix out of bounds write in detect thread space creation

src/detect-engine-filedata.c

@@ -40,10 +40,12 @@
 
 static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t size)
 {
-    void *ptmp;
     if (size > det_ctx->file_data_buffers_size) {
-        ptmp = SCRealloc(det_ctx->file_data,
-                         (det_ctx->file_data_buffers_size + BUFFER_STEP) * sizeof(FiledataReassembledBody));
+        uint16_t grow_by = size - det_ctx->file_data_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
+        void *ptmp = SCRealloc(det_ctx->file_data,
+                         (det_ctx->file_data_buffers_size + grow_by) * sizeof(FiledataReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->file_data);
             det_ctx->file_data = NULL;
@@ -53,10 +55,13 @@ static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t s
         }
         det_ctx->file_data = ptmp;
 
-        memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, BUFFER_STEP * sizeof(FiledataReassembledBody));
-        det_ctx->file_data_buffers_size += BUFFER_STEP;
+        memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, grow_by * sizeof(FiledataReassembledBody));
+        det_ctx->file_data_buffers_size += grow_by;
     }
-    for (int i = det_ctx->file_data_buffers_list_len; i < (size); i++) {
+    uint16_t i;
+    for (i = det_ctx->file_data_buffers_list_len;
+            i < det_ctx->file_data_buffers_size; i++)
+    {
         det_ctx->file_data[i].buffer_len = 0;
         det_ctx->file_data[i].offset = 0;
     }

src/detect-engine-hcbd.c

@@ -74,8 +74,11 @@ static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
 
     void *ptmp;
     if (size > det_ctx->hcbd_buffers_size) {
+        uint16_t grow_by = size - det_ctx->hcbd_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
         ptmp = SCRealloc(det_ctx->hcbd,
-                         (det_ctx->hcbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody));
+                         (det_ctx->hcbd_buffers_size + grow_by) * sizeof(HttpReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->hcbd);
             det_ctx->hcbd = NULL;
@@ -85,11 +88,11 @@ static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
         }
         det_ctx->hcbd = ptmp;
 
-        memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody));
-        det_ctx->hcbd_buffers_size += BUFFER_STEP;
+        memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, grow_by * sizeof(HttpReassembledBody));
+        det_ctx->hcbd_buffers_size += grow_by;
 
         uint16_t i;
-        for (i = det_ctx->hcbd_buffers_list_len; i < ((uint16_t)size); i++) {
+        for (i = det_ctx->hcbd_buffers_list_len; i < det_ctx->hcbd_buffers_size; i++) {
             det_ctx->hcbd[i].buffer_len = 0;
             det_ctx->hcbd[i].offset = 0;
         }

src/detect-engine-hsbd.c

@@ -76,8 +76,11 @@ static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
 
     void *ptmp;
     if (size > det_ctx->hsbd_buffers_size) {
+        uint16_t grow_by = size - det_ctx->hsbd_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
         ptmp = SCRealloc(det_ctx->hsbd,
-                         (det_ctx->hsbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody));
+                         (det_ctx->hsbd_buffers_size + grow_by) * sizeof(HttpReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->hsbd);
             det_ctx->hsbd = NULL;
@@ -87,11 +90,11 @@ static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
         }
         det_ctx->hsbd = ptmp;
 
-        memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody));
-        det_ctx->hsbd_buffers_size += BUFFER_STEP;
+        memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, grow_by * sizeof(HttpReassembledBody));
+        det_ctx->hsbd_buffers_size += grow_by;
     }
     uint16_t i;
-    for (i = det_ctx->hsbd_buffers_list_len; i < ((uint16_t)size); i++) {
+    for (i = det_ctx->hsbd_buffers_list_len; i < det_ctx->hsbd_buffers_size; i++) {
         det_ctx->hsbd[i].buffer_len = 0;
         det_ctx->hsbd[i].offset = 0;
         det_ctx->hsbd[i].decompressed_buffer_len = 0;