Skip to content

Commit

Permalink
spm/hs: don't exit on bad patterns
Browse files Browse the repository at this point in the history
A bad pattern in a rule that hyperscan would fail to compile would
exit Suricata. This could happen during a rule reload as well.

In case of a untrusted ruleset, this could potentially be used to
shut down the sensor.

Commit 7d0851b already blocks the only know case, but this patch
is more defensive.

Ticket: #6195.
  • Loading branch information
victorjulien committed Sep 13, 2023
1 parent 2b57179 commit 00e0025
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions src/util-spm-hs.c
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
/* Copyright (C) 2016 Open Information Security Foundation
/* Copyright (C) 2016-2023 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
Expand Down Expand Up @@ -84,7 +84,7 @@ static int HSBuildDatabase(const uint8_t *needle, uint16_t needle_len,
SCLogError("Unable to compile '%s' with Hyperscan, "
"returned %d.",
expr, err);
exit(EXIT_FAILURE);
return -1;
}

SCFree(expr);
Expand All @@ -96,7 +96,7 @@ static int HSBuildDatabase(const uint8_t *needle, uint16_t needle_len,
/* If scratch allocation failed, this is not recoverable: other SPM
* contexts may need this scratch space. */
SCLogError("Unable to alloc scratch for Hyperscan, returned %d.", err);
exit(EXIT_FAILURE);
return -1;
}
global_thread_ctx->ctx = scratch;
sctx->db = db;
Expand Down

0 comments on commit 00e0025

Please sign in to comment.