next/1469/20260828/v1 - #16141
Merged
Merged
Conversation
Zero the result when a byte_math right shift count reaches 64, the width of the uint64_t being shifted, so the operation no longer depends on behavior C11 6.5.7p3 leaves undefined. The left shift case has done this since 473ca6d; the right shift case was left unguarded. DetectByteMathDoMatch() shifted by whatever count it was handed. On x86_64 the hardware masks the count to its low six bits, so a count of 64 became a shift of 0 and returned the extracted value unchanged instead of 0. That value is stored in det_ctx->byte_values[] and feeds any byte_test, isdataat, or content offset later in the signature, so the signature's verdict follows from an arithmetic result the standard does not define. The count reaches the shift from the wire. When byte_math names a variable for rvalue, DetectEngineContentInspectionInternal() reads it out of det_ctx->byte_values[] at detect-engine-content-inspection.c:614, where a preceding byte_extract stored bytes taken from the payload, so one payload byte of 0x40 sets the count to 64. Issue: 8845
Fail rule load when byte_math pairs << or >> with a literal rvalue of 64 or more. rvalue was bounded only to u32::MAX, so a rule shifting by 100 loaded and then produced 0 for every packet it inspected, spending detection work on a comparison whose outcome was settled before the first packet arrived. A variable rvalue still loads. Its value comes from a byte_extract on the packet and is not known until the rule runs, so the guard in DetectByteMathDoMatch() stays the only check covering that path. DetectByteMathParse() reports every SCByteMathParse() failure as "invalid bytemath values", so the rejected rule is named by the "error parsing signature" line that follows rather than by the reason the parser gave. Issue: 8845
Record that << and >> yield 0 when rvalue is 64 or more, beside the existing note about division by zero. A shift count can come from a byte_extract variable, so the rule text alone does not say which counts land in that case. Issue: 8845
In very large rulesets with lots of different patterns the size calculation could overflow. Ticket: OISF#8844.
When reading an ERF file do not trust the ERF header values. Do not use wlen to set packet length. Ticket: 8836 Read rlen bytes into MAX_PAYLOAD_SIZE buffer. Use PacketCopyData() to safely update p. Ticket: 8865
Add support for ERF record types META and PAD, plus additional ETH types. Add support for ERF extension headers. These types and extension headers were already supported by erf-source-dag. Made source-erf-file and source-erf-dag more consistent. Ticket: 8962
When multithreaded output was enabled, all threads freed shallow-copy of sensor and prefix names. This commit adds a guard so that only the parent frees the allocated buffers. Ticket: 8861
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #16141 +/- ##
==========================================
+ Coverage 83.05% 83.09% +0.03%
==========================================
Files 1004 1004
Lines 277407 277514 +107
==========================================
+ Hits 230410 230603 +193
+ Misses 46997 46911 -86
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
Information: ERROR: QA failed on IPS_AFP_drop_chk.
Pipeline = 33444 |
Contributor
|
Consistent with original, approved, PRs. |
jasonish
approved these changes
Aug 28, 2026
jasonish
left a comment
jasonish
left a comment
Member
There was a problem hiding this comment.
Staging looks OK.. I'm not sure about the QA test, doesn't look related?
|
Information: QA ran without warnings. Pipeline = 33455 |
This was referenced Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Staging:
SV_BRANCH=OISF/suricata-verify#3334