mirror of
https://github.com/OISF/suricata.git
synced 2026-10-12 02:07:10 +00:00
detect/engine: guard SCInspectionBufferCheckAndExpand against overflow
Fix an infinite loop in SCInspectionBufferCheckAndExpand where doubling a uint32_t new_size can overflow if min_size is too large. This causes detection worker threads to spin at 100% CPU. This is a very unlikely scenario, but this patch hardens the logic to be defensive. Ticket: #8834.
This commit is contained in:
committed by
Victor Julien
parent
67e8779659
commit
40942ed64c
@@ -221,6 +221,11 @@ uint8_t *SCInspectionBufferCheckAndExpand(InspectionBuffer *buffer, uint32_t min
|
||||
|
||||
uint32_t new_size = (buffer->size == 0) ? 4096 : buffer->size;
|
||||
while (new_size < min_size) {
|
||||
/* guard against overflow */
|
||||
if (new_size > UINT32_MAX / 2) {
|
||||
new_size = min_size;
|
||||
break;
|
||||
}
|
||||
new_size *= 2;
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user