Fixes for out of bounds pcre_get_substring calls no longer silently accepted by modern pcre.

src/detect-dsize.c

@@ -155,6 +155,7 @@ DetectDsizeData *DetectDsizeParse (char *rawstr)
     mode = (char *)str_ptr;
     SCLogDebug("mode \"%s\"", mode);
 
+    if (ret >= 3) {
         res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr);
         if (res < 0) {
             SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed");
@@ -163,6 +164,7 @@ DetectDsizeData *DetectDsizeParse (char *rawstr)
         value1 = (char *)str_ptr;
         SCLogDebug("value1 \"%s\"", value1);
 
+        if (ret >= 4) {
             res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 3, &str_ptr);
             if (res < 0) {
                 SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed");
@@ -171,6 +173,7 @@ DetectDsizeData *DetectDsizeParse (char *rawstr)
             range = (char *)str_ptr;
             SCLogDebug("range \"%s\"", range);
 
+            if (ret >= 5) {
                 res = pcre_get_substring((char *)rawstr, ov, MAX_SUBSTRINGS, 4, &str_ptr);
                 if (res < 0) {
                     SCLogError(SC_ERR_PCRE_GET_SUBSTRING,"pcre_get_substring failed");
@@ -178,19 +181,28 @@ DetectDsizeData *DetectDsizeParse (char *rawstr)
                 }
                 value2 = (char *)str_ptr;
                 SCLogDebug("value2 \"%s\"", value2);
+            }
+        }
+    }
 
     dd = SCMalloc(sizeof(DetectDsizeData));
     if (dd == NULL)
         goto error;
     dd->dsize = 0;
     dd->dsize2 = 0;
+    dd->mode = DETECTDSIZE_EQ; // default
 
-    if (mode[0] == '<') dd->mode = DETECTDSIZE_LT;
+    if (mode != NULL) {
-    else if (mode[0] == '>') dd->mode = DETECTDSIZE_GT;
+        if (mode[0] == '<')
-    else dd->mode = DETECTDSIZE_EQ;
+            dd->mode = DETECTDSIZE_LT;
+        else if (mode[0] == '>')
+            dd->mode = DETECTDSIZE_GT;
+        else
+            dd->mode = DETECTDSIZE_EQ;
+    }
 
-    if (strcmp("<>", range) == 0) {
+    if (range != NULL && strcmp("<>", range) == 0) {
-        if (strlen(mode) != 0) {
+        if (mode != NULL && strlen(mode) != 0) {
             SCLogError(SC_ERR_INVALID_ARGUMENT,"Range specified but mode also set");
             goto error;
         }
@@ -204,7 +216,7 @@ DetectDsizeData *DetectDsizeParse (char *rawstr)
     }
 
     /** set the second dsize value if specified */
-    if (strlen(value2) > 0) {
+    if (value2 != NULL && strlen(value2) > 0) {
         if (dd->mode != DETECTDSIZE_RA) {
             SCLogError(SC_ERR_INVALID_ARGUMENT,"Multiple dsize values specified but mode is not range");
             goto error;
@@ -223,18 +235,27 @@ DetectDsizeData *DetectDsizeParse (char *rawstr)
 
     SCLogDebug("dsize parsed succesfully dsize: %"PRIu16" dsize2: %"PRIu16"",dd->dsize,dd->dsize2);
 
+    if (value1)
         SCFree(value1);
+    if (value2)
         SCFree(value2);
+    if (mode)
         SCFree(mode);
+    if (range)
         SCFree(range);
     return dd;
 
 error:
-    if (dd) SCFree(dd);
+    if (dd)
-    if (value1) SCFree(value1);
+        SCFree(dd);
-    if (value2) SCFree(value2);
+    if (value1)
-    if (mode) SCFree(mode);
+        SCFree(value1);
-    if (range) SCFree(range);
+    if (value2)
+        SCFree(value2);
+    if (mode)
+        SCFree(mode);
+    if (range)
+        SCFree(range);
     return NULL;
 }
 

src/detect-ttl.c

@@ -156,6 +156,7 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
     arg1 = (char *) str_ptr;
     SCLogDebug("Arg1 \"%s\"", arg1);
 
+    if (ret >= 3) {
         res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 2, &str_ptr);
         if (res < 0) {
             SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
@@ -164,6 +165,7 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
         arg2 = (char *) str_ptr;
         SCLogDebug("Arg2 \"%s\"", arg2);
 
+        if (ret >= 4) {
             res = pcre_get_substring((char *) ttlstr, ov, MAX_SUBSTRINGS, 3, &str_ptr);
             if (res < 0) {
                 SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
@@ -171,6 +173,8 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
             }
             arg3 = (char *) str_ptr;
             SCLogDebug("Arg3 \"%s\"", arg3);
+        }
+    }
 
     ttld = SCMalloc(sizeof (DetectTtlData));
     if (ttld == NULL)
@@ -178,9 +182,13 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
     ttld->ttl1 = 0;
     ttld->ttl2 = 0;
 
+    if (arg2 != NULL) {
         /*set the values*/
         switch(arg2[0]) {
             case '<':
+                if (arg3 == NULL)
+                    goto error;
+
                 ttld->mode = DETECT_TTL_LT;
                 ttld->ttl1 = (uint8_t) atoi(arg3);
 
@@ -190,6 +198,9 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
 
                 break;
             case '>':
+                if (arg3 == NULL)
+                    goto error;
+
                 ttld->mode = DETECT_TTL_GT;
                 ttld->ttl1 = (uint8_t) atoi(arg3);
 
@@ -199,13 +210,13 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
 
                 break;
             case '-':
-            if (strlen(arg1)== 0)
+                if (arg1 == NULL || strlen(arg1)== 0)
+                    goto error;
+                if (arg3 == NULL || strlen(arg3)== 0)
                     goto error;
 
                 ttld->mode = DETECT_TTL_RA;
                 ttld->ttl1 = (uint8_t) atoi(arg1);
-            if (strlen(arg3) == 0)
-                goto error;
 
                 ttld->ttl2 = (uint8_t) atoi(arg3);
                 SCLogDebug("ttl is %"PRIu8" and %"PRIu8"",ttld->ttl1, ttld->ttl2);
@@ -214,12 +225,22 @@ DetectTtlData *DetectTtlParse (char *ttlstr) {
             default:
                 ttld->mode = DETECT_TTL_EQ;
 
-            if (strlen(arg2) > 0 || strlen(arg3) > 0 || strlen(arg1) == 0)
+                if ((arg2 != NULL && strlen(arg2) > 0) || (arg3 != NULL && strlen(arg3) > 0) || (arg1 == NULL ||strlen(arg1) == 0))
                     goto error;
 
                 ttld->ttl1 = (uint8_t) atoi(arg1);
                 break;
         }
+    } else {
+        ttld->mode = DETECT_TTL_EQ;
+
+        if ((arg2 != NULL && strlen(arg2) > 0) ||
+                (arg3 != NULL && strlen(arg3) > 0) ||
+                (arg1 == NULL ||strlen(arg1) == 0))
+            goto error;
+
+        ttld->ttl1 = (uint8_t) atoi(arg1);
+    }
 
     SCFree(arg1);
     SCFree(arg2);