5 Commits (f57cacd3b39b4fac84100258884d4cd92f60f2d5)

Author	SHA1	Message	Date
Giuseppe Longo	d80d7f75a8	swf: grow lzma output in one decoder pass ... The on-demand buffer growth introduced for SWF decompression called lzma_decompress again from byte zero each time the output buffer filled. Because lzma-rs can buffer up to a dictionary before writing, a single SWF could be decoded repeatedly as the buffer grew, amplifying CPU use. This adds a depth-bounded Rust writer that asks C to grow the inspection buffer as decompressed bytes are emitted. This keeps a single lzma-rs stream alive, so the input is decoded only once. Ticket: #8829	2 months ago
Giuseppe Longo	ddc6d29fd1	swf: grow decompression buffer on demand ... Previously, SWF decompression guessed the final output size from FileLength, allocated the whole buffer, and then decompressed once. A malicious SWF could claim a 50MB output and force the per-thread inspection buffer to allocate and retain 64 MiB before the compressed data was even checked. Change the logic: allocate 4 KiB, decompress, grow only when the buffer is full, and continue. The buffer grows geometrically up to the configured output limit, and the final inspection length is set to the number of bytes actually produced. Also, for zlib, Z_OK does not by itself mean that decompression is complete. It should be checked together with avail_out and avail_in, grow the buffer when output space is exhausted, and continue the same inflate stream. Ticket: #8829	2 months ago
Daniel Olatunji	5c0af0b203	rust/doc: add docstring to rust module files. ... Issue: #4584	3 years ago
Victor Julien	64c0459d2d	rust/lzma: clippy fixup	4 years ago
Todd Mortimer	7d1a8cc335	file/swf: Use lzma-rs decompression instead of libhtp. ... Use the lzma-rs crate for decompressing swf/lzma files instead of the lzma decompressor in libhtp. This decouples suricata from libhtp except for actual http parsing, and means libhtp no longer has to export a lzma decompression interface. Ticket: #5638	4 years ago