Skip to content

tests: add test for bug 8856 - #3302

Open
victorjulien wants to merge 1 commit into
OISF:masterfrom
victorjulien:pppoe-8856/v2
Open

tests: add test for bug 8856#3302
victorjulien wants to merge 1 commit into
OISF:masterfrom
victorjulien:pppoe-8856/v2

Conversation

@victorjulien

Copy link
Copy Markdown
Member

Test reproduces DecodePPPOESession over-read with 7-byte PPPoE session header and non-zero pppoe_length. Verifies decoder.event.pppoe.pkt_too_small stat is raised.

Ticket: #8856.

Ticket

If your pull request is related to a Suricata ticket, please provide
the full URL to the ticket here so this pull request can monitor
changes to the ticket status:

Redmine ticket: https://redmine.openinfosecfoundation.org/issues/

@catenacyber

Copy link
Copy Markdown
Collaborator

Why is CI green ?

@victorjulien

Copy link
Copy Markdown
Member Author

Why is CI green ?

It only triggers on an ASAN enabled build.

@inashivb

Copy link
Copy Markdown
Member

Why is CI green ?

It only triggers on an ASAN enabled build.

We do build Suricata on ubuntu-24 job with ASAN.

@catenacyber

Copy link
Copy Markdown
Collaborator

I do not reproduce locally with ASAN on macOS

@victorjulien

Copy link
Copy Markdown
Member Author

Must have been mixing things up. I can't either, and neither with valgrind.

@catenacyber catenacyber added the requires suricata pr Depends on a PR in Suricata label Aug 25, 2026
Test reproduces DecodePPPOESession over-read with 7-byte PPPoE session
header and non-zero pppoe_length. Verifies decoder.event.pppoe.pkt_too_small
stat is raised.

The test won't fail on the branches w/o the fix, as the overread is
always in a larger block of memory and has no side effects.

Ticket: #8856.
@victorjulien

Copy link
Copy Markdown
Member Author

So this doesn't trigger the bug but it's still useful to have a test for this small packet condition.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

requires suricata pr Depends on a PR in Suricata

Development

Successfully merging this pull request may close these issues.

3 participants