From e281de36c099b7a9eb5c65da761a7de585fde233 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 6 Aug 2026 17:36:39 +0000 Subject: [PATCH] lua/flowvarlib: sanitize length in LuaFlowvarSet() LuaFlowvarSet() accepted a script-supplied integer for the copy length without validating it against the actual Lua string length returned by luaL_checkstring. This could lead to OOB memory access. This patch checks the length of the string before using it. Ticket: #8858. --- src/util-lua-flowvarlib.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/util-lua-flowvarlib.c b/src/util-lua-flowvarlib.c index 4ad74b4f10..9bd09b8b9b 100644 --- a/src/util-lua-flowvarlib.c +++ b/src/util-lua-flowvarlib.c @@ -101,8 +101,13 @@ static int LuaFlowvarValue(lua_State *L) static int LuaFlowvarSet(lua_State *L) { - const char *value = luaL_checkstring(L, 2); - const int len = (int)luaL_checkinteger(L, 3); + size_t slen = 0; + const char *value = luaL_checklstring(L, 2, &slen); + lua_Integer req = luaL_optinteger(L, 3, (lua_Integer)slen); + if (req < 0 || ((size_t)req > slen) || (size_t)req > UINT16_MAX) { + return luaL_error(L, "length out of range"); + } + const size_t len = (size_t)req; uint32_t *flowvar_id = luaL_checkudata(L, 1, suricata_flowvar_mt); Flow *f = LuaStateGetFlow(L); if (f == NULL) {