Skip to content

Commit 96f7549

Browse files
committed
detect/base64_data: reset buffer offset
When in a `base64_decode`-`base64_data` pair the decode was depending on another match through the relative option, the `buffer_offset` would be updated to the relative position of the previous match. During the `base64_data` phase, a relative match would use that offset even though the match happened in a new buffer. Example:: http.request_body; content:"|27|"; \ base64_decode:relative; \ base64_data; content:"|ff ff ff ff|"; within:16; This use of the `buffer_offset` is incorrect as that value is relative to a buffer and the `base64_data` points to a new buffer. This patch addresses this by resetting DetectEngineThreadCtx::buffer_offset before inspecting `base64_data`. Bug: OISF#7842. (cherry picked from commit 5f92a6c)
1 parent 7759e52 commit 96f7549

1 file changed

Lines changed: 1 addition & 0 deletions

File tree

src/detect-base64-data.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ int DetectBase64DataDoMatch(DetectEngineCtx *de_ctx,
6565
DetectEngineThreadCtx *det_ctx, const Signature *s, Flow *f)
6666
{
6767
if (det_ctx->base64_decoded_len) {
68+
det_ctx->buffer_offset = 0;
6869
return DetectEngineContentInspection(de_ctx, det_ctx, s,
6970
s->sm_arrays[DETECT_SM_LIST_BASE64_DATA], NULL, f, det_ctx->base64_decoded,
7071
det_ctx->base64_decoded_len, 0, DETECT_CI_FLAGS_SINGLE,

0 commit comments

Comments
 (0)