mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
29a5370e71
Replace the hardcoded 16 MiB record caps with configurable
max-{write,read}-size and observable events: an oversized WRITE
request or READ response is rejected, logged, and its payload skipped
to keep the stream in sync. 0 disables the check.
For v4 records, the issue is more complex due to the COMPOUND type:
A partial v4 COMPOUND record whose frag_len claim is huge must not be
buffered toward that claim (31-bit, attacker-controlled → OOM). The
full parser can't help: on a partial buffer it only returns Incomplete
("need more bytes"), with no information about what's coming. The scan
instead walks the buffered prefix's ops by wire extent and reads the
file op's header words alone, answering the gate's four-way question:
oversized claim detected (reject + skip to the record boundary before
any data buffers), data not yet present (buffer normally), structurall
malformed (bounded rejection), or no oversized op (fall through). It
exists because rejecting before buffering requires the claimed length,
which only a prefix walk can extract.
Ticket: #8791.
|
2 months ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 6 months ago | |
| ffi | 2 months ago | |
| htp | 2 months ago | |
| src | 2 months ago | |
| suricatactl | 8 months ago | |
| suricatasc | 4 months ago | |
| sys | 2 months ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 2 months ago | |
| Cargo.toml.in | 2 months ago | |
| Makefile.am | 3 months ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | 3 years ago | |