From 968ed663a8e129bf502b0fa6c743c4e9b383e0b6 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Mon, 11 Dec 2017 14:07:14 +0100
Subject: [PATCH] detect: fix out of bounds write in detect thread space
 creation

---
 src/detect-engine-filedata.c | 17 +++++++++++------
 src/detect-engine-hcbd.c     | 11 +++++++----
 src/detect-engine-hsbd.c     | 11 +++++++----
 3 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/src/detect-engine-filedata.c b/src/detect-engine-filedata.c
index f9b7f55f39..bf751e16cd 100644
--- a/src/detect-engine-filedata.c
+++ b/src/detect-engine-filedata.c
@@ -40,10 +40,12 @@
 
 static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t size)
 {
-    void *ptmp;
     if (size > det_ctx->file_data_buffers_size) {
-        ptmp = SCRealloc(det_ctx->file_data,
-                         (det_ctx->file_data_buffers_size + BUFFER_STEP) * sizeof(FiledataReassembledBody));
+        uint16_t grow_by = size - det_ctx->file_data_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
+        void *ptmp = SCRealloc(det_ctx->file_data,
+                         (det_ctx->file_data_buffers_size + grow_by) * sizeof(FiledataReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->file_data);
             det_ctx->file_data = NULL;
@@ -53,10 +55,13 @@ static inline int FiledataCreateSpace(DetectEngineThreadCtx *det_ctx, uint16_t s
         }
         det_ctx->file_data = ptmp;
 
-        memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, BUFFER_STEP * sizeof(FiledataReassembledBody));
-        det_ctx->file_data_buffers_size += BUFFER_STEP;
+        memset(det_ctx->file_data + det_ctx->file_data_buffers_size, 0, grow_by * sizeof(FiledataReassembledBody));
+        det_ctx->file_data_buffers_size += grow_by;
     }
-    for (int i = det_ctx->file_data_buffers_list_len; i < (size); i++) {
+    uint16_t i;
+    for (i = det_ctx->file_data_buffers_list_len;
+            i < det_ctx->file_data_buffers_size; i++)
+    {
         det_ctx->file_data[i].buffer_len = 0;
         det_ctx->file_data[i].offset = 0;
     }
diff --git a/src/detect-engine-hcbd.c b/src/detect-engine-hcbd.c
index 6d511b629a..df27e9e7e8 100644
--- a/src/detect-engine-hcbd.c
+++ b/src/detect-engine-hcbd.c
@@ -74,8 +74,11 @@ static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
 
     void *ptmp;
     if (size > det_ctx->hcbd_buffers_size) {
+        uint16_t grow_by = size - det_ctx->hcbd_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
         ptmp = SCRealloc(det_ctx->hcbd,
-                         (det_ctx->hcbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody));
+                         (det_ctx->hcbd_buffers_size + grow_by) * sizeof(HttpReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->hcbd);
             det_ctx->hcbd = NULL;
@@ -85,11 +88,11 @@ static inline int HCBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
         }
         det_ctx->hcbd = ptmp;
 
-        memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody));
-        det_ctx->hcbd_buffers_size += BUFFER_STEP;
+        memset(det_ctx->hcbd + det_ctx->hcbd_buffers_size, 0, grow_by * sizeof(HttpReassembledBody));
+        det_ctx->hcbd_buffers_size += grow_by;
 
         uint16_t i;
-        for (i = det_ctx->hcbd_buffers_list_len; i < ((uint16_t)size); i++) {
+        for (i = det_ctx->hcbd_buffers_list_len; i < det_ctx->hcbd_buffers_size; i++) {
             det_ctx->hcbd[i].buffer_len = 0;
             det_ctx->hcbd[i].offset = 0;
         }
diff --git a/src/detect-engine-hsbd.c b/src/detect-engine-hsbd.c
index f64f761c29..8476689824 100644
--- a/src/detect-engine-hsbd.c
+++ b/src/detect-engine-hsbd.c
@@ -76,8 +76,11 @@ static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
 
     void *ptmp;
     if (size > det_ctx->hsbd_buffers_size) {
+        uint16_t grow_by = size - det_ctx->hsbd_buffers_size;
+        grow_by = MAX(grow_by, BUFFER_STEP);
+
         ptmp = SCRealloc(det_ctx->hsbd,
-                         (det_ctx->hsbd_buffers_size + BUFFER_STEP) * sizeof(HttpReassembledBody));
+                         (det_ctx->hsbd_buffers_size + grow_by) * sizeof(HttpReassembledBody));
         if (ptmp == NULL) {
             SCFree(det_ctx->hsbd);
             det_ctx->hsbd = NULL;
@@ -87,11 +90,11 @@ static inline int HSBDCreateSpace(DetectEngineThreadCtx *det_ctx, uint64_t size)
         }
         det_ctx->hsbd = ptmp;
 
-        memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, BUFFER_STEP * sizeof(HttpReassembledBody));
-        det_ctx->hsbd_buffers_size += BUFFER_STEP;
+        memset(det_ctx->hsbd + det_ctx->hsbd_buffers_size, 0, grow_by * sizeof(HttpReassembledBody));
+        det_ctx->hsbd_buffers_size += grow_by;
     }
     uint16_t i;
-    for (i = det_ctx->hsbd_buffers_list_len; i < ((uint16_t)size); i++) {
+    for (i = det_ctx->hsbd_buffers_list_len; i < det_ctx->hsbd_buffers_size; i++) {
         det_ctx->hsbd[i].buffer_len = 0;
         det_ctx->hsbd[i].offset = 0;
         det_ctx->hsbd[i].decompressed_buffer_len = 0;