Actions
Bug #3910
closeddatasets: for type string the memcap isn't applied to the string data
Affected Versions:
Effort:
Difficulty:
Label:
Description
The memcap checking and tracking only tracks the fixed size THashData
and StringType
, but not the length of the data in StringType::ptr
.
Updated by Victor Julien about 4 years ago
- Status changed from New to Assigned
- Assignee set to Shivani Bhardwaj
- Target version set to 7.0.0-beta1
Updated by Victor Julien over 3 years ago
One issue is how to deal with upgrades. If suddenly more data is accounted in the memcap, existing setups might suddenly hit the memcap after upgrading.
Updated by Jason Ish over 3 years ago
I don't see a nice way about it. Does this mostly refer to setting of a memcap in a rule where the user will have a harder time changing it assuming they are getting it from a 3rd source?
Could we define a dataset name under datasets before loading the rule that defines that dataset, the memcap set there would serve as an override?
Updated by Victor Julien about 3 years ago
- Target version changed from 7.0.0-beta1 to 8.0.0-beta1
Updated by Shivani Bhardwaj 6 months ago
- Status changed from Assigned to In Review
In Review PR: https://github.com/OISF/suricata/pull/11047
Updated by Shivani Bhardwaj 4 months ago
- Status changed from In Review to Closed
Closed by: https://github.com/OISF/suricata/pull/11402
Actions