Actions
Bug #5905
closedinvalid bsize and distance rule being loaded by suricata
Affected Versions:
Effort:
Difficulty:
Label:
Description
Found by oss-fuzz
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=56067&q=label%3AProj-suricata
Reproducer is drop ip :: 0 <> :: 4 ipv6.hdr;bsize:8;content:" ";disTance:-5;content:" ";disTance:-020000000000;
It gets to a signed integer overflow with detect-content.c:452:19: runtime error: signed integer overflow: -4 + -2147483647 cannot be represented in type 'int'
Somehow introduced by #2982 fix https://github.com/OISF/suricata/pull/8124 but I guess the root cause existed before
I guess one part of the fix is to use precise integer types for arguments of SigParseRequiredContentSize
Actions