From c977b2f31bc404b1d5ab40e55ab11fd11f8d5235 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Fri, 1 May 2026 11:57:25 +0200 Subject: [PATCH] frames: make sure we use a lowercase buffer name Ticket: 8526 As some C protocols accepted case-insensitive frame names, a rule using the same frame twice with different cases, ended up using 2 different buffers, which ended up in triggering a buffer overflow --- src/detect-frame.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/detect-frame.c b/src/detect-frame.c index 72132b355e..ddb73808df 100644 --- a/src/detect-frame.c +++ b/src/detect-frame.c @@ -132,6 +132,11 @@ static int DetectFrameSetup(DetectEngineCtx *de_ctx, Signature *s, const char *s strlcpy(buffer_name, str, sizeof(buffer_name)); SCLogDebug("long name: %s", buffer_name); } + // make sure the buffer name is lowercase + // even if the protocol accepted case-insensitive frame name + for (size_t i = 0; i < sizeof(buffer_name) && buffer_name[i]; i++) { + buffer_name[i] = u8_tolower(buffer_name[i]); + } uint8_t frame_type = (uint8_t)raw_frame_type; /* TODO we can have TS and TC specific frames */