mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
07225b9527
The output of ndpi_dpi2json() is inserted into the EVE record as is, so a malformed fragment takes the whole record down with it. nDPI 6.0 does produce one: its serializer sizes the buffer for the unescaped length of a string, its new string escaper expands non printable characters and returns -1 when it runs out of room, and the callers add that -1 to the buffer position. A DNS flow whose name is full of non printable characters hits this, which is what the dns-truncated-rname suricata-verify test exercises. Check the syntax of the fragment before inserting it and drop the nDPI object of the record otherwise, with a warning the first time. The same applies when SCJbSetFormatted() rejects it as invalid UTF-8. The fragment is also copied to a terminated string first, as nDPI only terminates its buffer when there is room left for it. Also start the serializer with a 4KiB buffer through ndpi_init_serializer_ll() rather than nDPI's 256 byte default, so the escaper has room to expand strings in the common case. The strings nDPI serializes are not bounded, so the check stays as the safety net. Ticket: 8077 |
4 weeks ago | |
|---|---|---|
| .. | ||
| napatech | 7 months ago | |
| ndpi | 4 weeks ago | |
| pfring | 5 months ago | |
| Makefile.am | 2 years ago | |