detect: fail properly on invalid transform pcrexform

src/detect-parse.c

@@ -2431,32 +2431,35 @@ void DetectParseRegexAddToFreeList(DetectParseRegex *detect_parse)
     g_detect_parse_regex_list = r;
 }
 
-void DetectSetupParseRegexesOpts(const char *parse_str, DetectParseRegex *detect_parse, int opts)
+bool DetectSetupParseRegexesOpts(const char *parse_str, DetectParseRegex *detect_parse, int opts)
 {
     const char *eb;
     int eo;
 
     detect_parse->regex = pcre_compile(parse_str, opts, &eb, &eo, NULL);
     if (detect_parse->regex == NULL) {
-        FatalError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at "
+        SCLogError(SC_ERR_PCRE_COMPILE, "pcre compile of \"%s\" failed at "
                 "offset %" PRId32 ": %s", parse_str, eo, eb);
+        return false;
     }
 
     detect_parse->study = pcre_study(detect_parse->regex, 0 , &eb);
     if (eb != NULL) {
-        FatalError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
+        SCLogError(SC_ERR_PCRE_STUDY, "pcre study failed: %s", eb);
+        return false;
     }
 
 
     DetectParseRegexAddToFreeList(detect_parse);
 
-    return;
+    return true;
 }
 
 void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *detect_parse)
 {
-    DetectSetupParseRegexesOpts(parse_str, detect_parse, 0);
-    return;
+    if (!DetectSetupParseRegexesOpts(parse_str, detect_parse, 0)) {
+        FatalError(SC_ERR_PCRE_COMPILE, "pcre compile and study failed");
+    }
 }
 
 

src/detect-parse.h

@@ -88,7 +88,7 @@ int WARN_UNUSED DetectSignatureSetAppProto(Signature *s, AppProto alproto);
 
 /* parse regex setup and free util funcs */
 
-void DetectSetupParseRegexesOpts(const char *parse_str, DetectParseRegex *parse_regex, int opts);
+bool DetectSetupParseRegexesOpts(const char *parse_str, DetectParseRegex *parse_regex, int opts);
 void DetectSetupParseRegexes(const char *parse_str, DetectParseRegex *parse_regex);
 void DetectParseRegexAddToFreeList(DetectParseRegex *parse_regex);
 void DetectParseFreeRegexes(void);

src/detect-pcre.c

@@ -154,8 +154,10 @@ void DetectPcreRegister (void)
     DetectSetupParseRegexes(PARSE_REGEX, &parse_regex);
 
     /* setup the capture regex, as it needs PCRE_UNGREEDY we do it manually */
-    int opts = PCRE_UNGREEDY; /* pkt_http_ua should be pkt, http_ua, for this reason the UNGREEDY */
-    DetectSetupParseRegexesOpts(PARSE_CAPTURE_REGEX, &parse_capture_regex, opts);
+    /* pkt_http_ua should be pkt, http_ua, for this reason the UNGREEDY */
+    if (!DetectSetupParseRegexesOpts(PARSE_CAPTURE_REGEX, &parse_capture_regex, PCRE_UNGREEDY)) {
+        FatalError(SC_ERR_PCRE_COMPILE, "pcre compile and study failed");
+    }
 
 #ifdef PCRE_HAVE_JIT
     if (PageSupportsRWX() == 0) {

src/detect-transform-pcrexform.c

@@ -35,6 +35,9 @@ typedef DetectParseRegex DetectTransformPcrexformData;
 static int DetectTransformPcrexformSetup (DetectEngineCtx *, Signature *, const char *);
 static void DetectTransformPcrexformFree(DetectEngineCtx *, void *);
 static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options);
+#ifdef UNITTESTS
+void DetectTransformPcrexformRegisterTests (void);
+#endif
 
 void DetectTransformPcrexformRegister(void)
 {
@@ -48,6 +51,9 @@ void DetectTransformPcrexformRegister(void)
         DetectTransformPcrexformFree;
     sigmatch_table[DETECT_TRANSFORM_PCREXFORM].Setup =
         DetectTransformPcrexformSetup;
+#ifdef UNITTESTS
+    sigmatch_table[DETECT_TRANSFORM_PCREXFORM].RegisterTests = DetectTransformPcrexformRegisterTests;
+#endif
     sigmatch_table[DETECT_TRANSFORM_PCREXFORM].flags |= SIGMATCH_QUOTES_MANDATORY;
 }
 
@@ -78,7 +84,10 @@ static int DetectTransformPcrexformSetup (DetectEngineCtx *de_ctx, Signature *s,
         SCReturnInt(-1);
     }
 
-    DetectSetupParseRegexes(regexstr, pxd);
+    if (!DetectSetupParseRegexesOpts(regexstr, pxd, 0)) {
+        SCFree(pxd);
+        SCReturnInt(-1);
+    }
 
     int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_PCREXFORM, pxd);
     if (r != 0) {
@@ -108,3 +117,7 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options)
         }
     }
 }
+
+#ifdef UNITTESTS
+#include "tests/detect-transform-pcrexform.c"
+#endif

src/tests/detect-transform-pcrexform.c

@@ -0,0 +1,67 @@
+/* Copyright (C) 2020 Open Information Security Foundation
+ *
+ * You can copy, redistribute or modify this Program under the terms of
+ * the GNU General Public License version 2 as published by the Free
+ * Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * version 2 along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
+ * 02110-1301, USA.
+ */
+
+#include "../suricata-common.h"
+
+#include "../detect-engine.h"
+
+#include "../detect-transform-pcrexform.h"
+
+#include "../util-unittest.h"
+
+/**
+ * \test signature with an invalid pcrexform value.
+ */
+
+static int DetectTransformPcrexformParseTest01 (void)
+{
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
+
+    Signature *sig = DetectEngineAppendSig(de_ctx,
+            "alert tcp any any <> any 1 pcrexform:\"[\";");
+    FAIL_IF_NOT_NULL(sig);
+
+    DetectEngineCtxFree(de_ctx);
+    PASS;
+}
+
+/**
+ * \test signature with a valid pcrexform value.
+ */
+
+static int DetectTransformPcrexformParseTest02 (void)
+{
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
+
+    Signature *sig = DetectEngineAppendSig(de_ctx,
+            "alert http any any -> any any (msg:\"HTTP with pcrexform\"; http.request_line; pcrexform:\"[a-zA-Z]+\\s+(.*)\\s+HTTP\"; content:\"/z4d4kWk.jpg\"; sid:1;)");
+    FAIL_IF_NULL(sig);
+
+    DetectEngineCtxFree(de_ctx);
+    PASS;
+}
+
+/**
+ * \brief this function registers unit tests for DetectTransformPcrexform
+ */
+void DetectTransformPcrexformRegisterTests(void)
+{
+    UtRegisterTest("DetectTransformPcrexformParseTest01", DetectTransformPcrexformParseTest01);
+    UtRegisterTest("DetectTransformPcrexformParseTest02", DetectTransformPcrexformParseTest02);
+}