mirror of
https://git.yoctoproject.org/meta-security
synced 2026-01-11 15:00:34 +00:00
df1781ceb6
Backport fixes for: * CVE-2025-29916 - Upstream-Status: Backport from2f432c99a9&&e28c8c655a&&d86c5f9f0c* CVE-2025-29917 - Upstream-Status: Backport frombab716776b* CVE-2025-29918 - Upstream-Status: Backport fromf6c9490e1fSigned-off-by: Hitendra Prajapati <hprajapati@mvista.com> Signed-off-by: Scott Murray <scott.murray@konsulko.com>
50 lines
1.9 KiB
Diff
50 lines
1.9 KiB
Diff
From f6c9490e1f7b0b375c286d5313ebf3bc81a95eb6 Mon Sep 17 00:00:00 2001
|
|
From: Philippe Antoine <pantoine@oisf.net>
|
|
Date: Tue, 28 Jan 2025 15:02:45 +0100
|
|
Subject: [PATCH] detect/pcre: avoid infinite loop after negated pcre
|
|
|
|
Ticket: 7526
|
|
|
|
The usage of negated pcre, followed by other relative payload
|
|
content keywords could lead to an infinite loop.
|
|
|
|
This is because regular (not negated) pcre can test multiple
|
|
occurences, but negated pcre should be tried only once.
|
|
|
|
(cherry picked from commit b14c67cbdf25fa6c7ffe0d04ddf3ebe67b12b50b)
|
|
|
|
Upstream-Status: Backport [https://github.com/OISF/suricata/commit/f6c9490e1f7b0b375c286d5313ebf3bc81a95eb6]
|
|
CVE: CVE-2025-29918
|
|
Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
|
|
---
|
|
src/detect-engine-content-inspection.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
|
|
index 77ebb3f..2a789c9 100644
|
|
--- a/src/detect-engine-content-inspection.c
|
|
+++ b/src/detect-engine-content-inspection.c
|
|
@@ -450,7 +450,6 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
|
|
if (r == 0) {
|
|
goto no_match;
|
|
}
|
|
-
|
|
if (!(pe->flags & DETECT_PCRE_RELATIVE_NEXT)) {
|
|
SCLogDebug("no relative match coming up, so this is a match");
|
|
goto match;
|
|
@@ -473,6 +472,11 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
|
|
if (det_ctx->discontinue_matching)
|
|
goto no_match;
|
|
|
|
+ if (prev_offset == 0) {
|
|
+ // This happens for negated PCRE
|
|
+ // We do not search for another occurrence of this pcre
|
|
+ SCReturnInt(0);
|
|
+ }
|
|
det_ctx->buffer_offset = prev_buffer_offset;
|
|
det_ctx->pcre_match_start_offset = prev_offset;
|
|
} while (1);
|
|
--
|
|
2.49.0
|
|
|