issue 1961: depth: fail if numeric value has trailing text

Catches the case where the depth is not terminated with a
semicolon (eg: "depth:17 classtype:trojan-activity") which
is usually a sign the rule has a missing semi-colon.
pull/2428/head
Jason Ish 9 years ago committed by Victor Julien
parent a1eca40611
commit c91974e24a

@ -37,6 +37,7 @@
#include "flow-var.h" #include "flow-var.h"
#include "app-layer.h" #include "app-layer.h"
#include "util-byte.h"
#include "util-debug.h" #include "util-debug.h"
static int DetectDepthSetup (DetectEngineCtx *, Signature *, char *); static int DetectDepthSetup (DetectEngineCtx *, Signature *, char *);
@ -137,11 +138,10 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
cd->depth = ((DetectByteExtractData *)bed_sm->ctx)->local_id; cd->depth = ((DetectByteExtractData *)bed_sm->ctx)->local_id;
cd->flags |= DETECT_CONTENT_DEPTH_BE; cd->flags |= DETECT_CONTENT_DEPTH_BE;
} else { } else {
cd->depth = (uint32_t)atoi(str); if (ByteExtractStringUint16(&cd->depth, 0, 0, str) != (int)strlen(str))
if (cd->depth < cd->content_len) { {
SCLogError(SC_ERR_INVALID_SIGNATURE, "depth - %"PRIu16 SCLogError(SC_ERR_INVALID_SIGNATURE,
" smaller than content length - %"PRIu32, "invalid value for depth: %s", str);
cd->depth, cd->content_len);
goto end; goto end;
} }
/* Now update the real limit, as depth is relative to the offset */ /* Now update the real limit, as depth is relative to the offset */

Loading…
Cancel
Save