Suricata

Victor Julien wrote in #note-3:

What is the impact of this?

Undefined behavior cf https://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html

-fsanitize=vla-bound: A variable-length array whose bound does not evaluate to a positive value.

I do not think there is a real impact

How do we end up with a 0 byte input btw?

Victor Julien wrote in #note-5:

How do we end up with a 0 byte input btw?

Looks easy, like a http header with an empty value : 0 byte input

https://github.com/OISF/suricata/pull/11869