mirror of https://github.com/OISF/suricata
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Previously, SWF decompression guessed the final output size from FileLength, allocated the whole buffer, and then decompressed once. A malicious SWF could claim a 50MB output and force the per-thread inspection buffer to allocate and retain 64 MiB before the compressed data was even checked. Change the logic: allocate 4 KiB, decompress, grow only when the buffer is full, and continue. The buffer grows geometrically up to the configured output limit, and the final inspection length is set to the number of bytes actually produced. Also, for zlib, Z_OK does not by itself mean that decompression is complete. It should be checked together with avail_out and avail_in, grow the buffer when output space is exhausted, and continue the same inflate stream. Ticket: #8829 |
2 months ago | |
|---|---|---|
| .. | ||
| .cargo | 2 years ago | |
| derive | 6 months ago | |
| ffi | 2 months ago | |
| htp | 2 months ago | |
| src | 2 months ago | |
| suricatactl | 7 months ago | |
| suricatasc | 4 months ago | |
| sys | 2 months ago | |
| .gitignore | 2 years ago | |
| Cargo.lock.in | 2 months ago | |
| Cargo.toml.in | 2 months ago | |
| Makefile.am | 2 months ago | |
| cbindgen.toml | 4 months ago | |
| rustfmt.toml | ||