detect/uint: make invalid range a failure

By converting the invalid range to a failure instead of just an error,
the integer parser won't fall through to the equals parser which is
lenient and will parse a range as an equals.

Author: jasonish

rust/src/detect/uint.rs

@@ -18,7 +18,7 @@
 use nom7::branch::alt;
 use nom7::bytes::complete::{is_a, tag, tag_no_case, take, take_while};
 use nom7::character::complete::{anychar, char, digit1, hex_digit1, i32 as nom_i32};
-use nom7::combinator::{all_consuming, map_opt, opt, value, verify};
+use nom7::combinator::{all_consuming, cut, map_opt, opt, value, verify};
 use nom7::error::{make_error, Error, ErrorKind};
 use nom7::Err;
 use nom7::IResult;
@@ -585,9 +585,13 @@ pub fn detect_parse_uint_start_interval<T: DetectIntType>(
     let (i, _) = opt(is_a(" "))(i)?;
     let (i, _) = alt((tag("-"), tag("<>")))(i)?;
     let (i, _) = opt(is_a(" "))(i)?;
-    let (i, arg2) = verify(detect_parse_uint_value, |x| {
+
+    // As we've determined this is range, use cut to turn the error
+    // into a failure so usage inside alt doesn't continue onto the
+    // next item.
+    let (i, arg2) = cut(verify(detect_parse_uint_value, |x| {
         x > &arg1 && *x - arg1 > T::one()
-    })(i)?;
+    }))(i)?;
     let mode = if neg.is_some() {
         DetectUintMode::DetectUintModeNegRg
     } else {
@@ -1045,17 +1049,10 @@ mod tests {
     }
 
     #[test]
-    fn test_null_range() {
-        // This is OK and expected.
-        let (_, val) = detect_parse_uint_notending::<u8>("1<>3").unwrap();
-        assert_eq!(val.arg1, 1);
-        assert_eq!(val.arg2, 3);
-        assert_eq!(val.mode, DetectUintMode::DetectUintModeRange);
-
-        // Is this expected?
-        let (_, val) = detect_parse_uint_notending::<u8>("1<>2").unwrap();
-        assert_eq!(val.arg1, 1);
-        assert_eq!(val.arg2, 0);
-        assert_eq!(val.mode, DetectUintMode::DetectUintModeEqual);
+    fn test_invalid_range() {
+        // Invalid range - should fail (not enough values between bounds)
+        assert!(detect_parse_uint_notending::<u8>("1<>2").is_err());
+        assert!(detect_parse_uint_notending::<u8>("1-2").is_err());
+        assert!(detect_parse_uint_notending::<u8>("1-1").is_err());
     }
 }

src/detect-urilen.c

@@ -475,16 +475,15 @@ static int DetectUrilenSetpTest01(void)
     Signature *sig = NULL;
     DetectEngineCtx *de_ctx = NULL;
 
-    res = DetectUrilenInitTest(&de_ctx, &sig, &urilend, "1 <> 2 ");
-    if (res == 0) {
+    if (!DetectUrilenInitTest(&de_ctx, &sig, &urilend, "1 <> 3 ")) {
         goto end;
-    }
+    }        
 
     if(urilend == NULL)
         goto cleanup;
 
     if (urilend != NULL) {
-        if (urilend->du16.arg1 == 1 && urilend->du16.arg2 == 2 &&
+        if (urilend->du16.arg1 == 1 && urilend->du16.arg2 == 3 &&
                 urilend->du16.mode == DETECT_UINT_RA)
             res = 1;
     }