Skip to content

Commit 1fe9d18

Browse files
chenglongfeijasonish
authored andcommitted
lua: fix null dereference in tx HTTP accessor functions
Fix crashes in Lua when calling tx:response_line(), tx:request_line(), tx:request_uri_raw(), or tx:request_host() on incomplete or malformed HTTP transactions. These functions return bstr pointers which may be NULL. Add NULL checks before calling bstr_ptr() and bstr_len() to avoid segfaults. Ticket: OISF#7829
1 parent 24503b0 commit 1fe9d18

1 file changed

Lines changed: 27 additions & 9 deletions

File tree

src/util-lua-http.c

Lines changed: 27 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
*/
2424

2525
#include "suricata-common.h"
26-
26+
#include "htp/htp_rs.h"
2727
#include "app-layer-htp.h"
2828
#include "util-lua.h"
2929
#include "util-lua-common.h"
@@ -65,9 +65,13 @@ static int LuaHttpGetRequestHost(lua_State *luastate)
6565
lua_pushnil(luastate);
6666
return 1;
6767
}
68+
const struct bstr *host = htp_tx_request_hostname(tx->tx);
69+
if (host == NULL) {
70+
lua_pushnil(luastate);
71+
return 1;
72+
}
6873

69-
return LuaPushStringBuffer(luastate, bstr_ptr(htp_tx_request_hostname(tx->tx)),
70-
bstr_len(htp_tx_request_hostname(tx->tx)));
74+
return LuaPushStringBuffer(luastate, bstr_ptr(host), bstr_len(host));
7175
}
7276

7377
static int LuaHttpGetRequestUriRaw(lua_State *luastate)
@@ -77,9 +81,13 @@ static int LuaHttpGetRequestUriRaw(lua_State *luastate)
7781
lua_pushnil(luastate);
7882
return 1;
7983
}
84+
const struct bstr *uri = htp_tx_request_uri(tx->tx);
85+
if (uri == NULL) {
86+
lua_pushnil(luastate);
87+
return 1;
88+
}
8089

81-
return LuaPushStringBuffer(
82-
luastate, bstr_ptr(htp_tx_request_uri(tx->tx)), bstr_len(htp_tx_request_uri(tx->tx)));
90+
return LuaPushStringBuffer(luastate, bstr_ptr(uri), bstr_len(uri));
8391
}
8492

8593
static int LuaHttpGetRequestUriNormalized(lua_State *luastate)
@@ -107,8 +115,13 @@ static int LuaHttpGetRequestLine(lua_State *luastate)
107115
return 1;
108116
}
109117

110-
return LuaPushStringBuffer(
111-
luastate, bstr_ptr(htp_tx_request_line(tx->tx)), bstr_len(htp_tx_request_line(tx->tx)));
118+
const struct bstr *line = htp_tx_request_line(tx->tx);
119+
if (line == NULL) {
120+
lua_pushnil(luastate);
121+
return 1;
122+
}
123+
124+
return LuaPushStringBuffer(luastate, bstr_ptr(line), bstr_len(line));
112125
}
113126

114127
static int LuaHttpGetResponseLine(lua_State *luastate)
@@ -119,8 +132,13 @@ static int LuaHttpGetResponseLine(lua_State *luastate)
119132
return 1;
120133
}
121134

122-
return LuaPushStringBuffer(luastate, bstr_ptr(htp_tx_response_line(tx->tx)),
123-
bstr_len(htp_tx_response_line(tx->tx)));
135+
const struct bstr *line = htp_tx_response_line(tx->tx);
136+
if (line == NULL) {
137+
lua_pushnil(luastate);
138+
return 1;
139+
}
140+
141+
return LuaPushStringBuffer(luastate, bstr_ptr(line), bstr_len(line));
124142
}
125143

126144
static int LuaHttpGetHeader(lua_State *luastate, int dir)

0 commit comments

Comments
 (0)