mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
bf64b52b95
Ticket: 8513 Suricata decides at 2 levels if a http2 flow is doing a compression bomb. There is a direct computation when one chunk of TCP data is being parsed. In this case, do not take the ratio into account, just use the size of the decompressed data, so that if we get a big chunk of TCP data like 1 MiB, and a not so high ratio of 200, we do not trigger the debug assertion in util-file.c about 64MiB The other case stays unchanged : when accumulating over the lifetile of a flow with multiple txs, take into account the compression ratio, so that a flow of many txs, having a super high (brotli) compression ratio, ends up classified as a compression bomb. (For example, having 100 txs each turning a 100 byte input into a 700 KiB one) |
4 months ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 4 months ago | |
| ffi | 4 months ago | |
| htp | 8 months ago | |
| src | 4 months ago | |
| suricatactl | 6 months ago | |
| suricatasc | 6 months ago | |
| sys | 4 months ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 4 months ago | |
| Cargo.toml.in | 7 months ago | |
| Makefile.am | 5 months ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | 3 years ago | |