Skip to content

Rfb max length 8731 v3.5 - #16163

Closed
catenacyber wants to merge 2 commits into
OISF:mainfrom
catenacyber:rfb-max-length-8731-v3.5
Closed

Rfb max length 8731 v3.5#16163
catenacyber wants to merge 2 commits into
OISF:mainfrom
catenacyber:rfb-max-length-8731-v3.5

Conversation

@catenacyber

@catenacyber catenacyber commented Sep 2, 2026

Copy link
Copy Markdown
Contributor

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8731

Describe changes:

  • rfb: limit strings length

SV_BRANCH=OISF/suricata-verify#3342

#16159 after review

@catenacyber
rfb: limit strings length
88f175f 
Ticket: 8731

Adds a configurable limit to string lengths to avoid to retain
too much memory for too long, and avoid producing log events
that are too big
@catenacyber
rfb: keep failure_reason as Vec<u8>
fd1b56c 
And log it with from_utf8_lossy

Since we may now cut a too big failure_reason breaking a valid
utf-8 string

Ticket: 8731
@catenacyber
catenacyber requested review from a team, jasonish and jufajardini as code owners September 2, 2026 07:29
@catenacyber catenacyber mentioned this pull request Sep 2, 2026
Closed
@suricata-review-bot

suricata-review-bot commented Sep 2, 2026

Copy link
Copy Markdown

AI-generated review posted automatically by Suricata ai-review.

Verdict: request changes

  • High — rust/src/rfb/rfb.rs:776: A server-controlled oversized ServerInit name spanning TCP segments can make request.to_skip exceed rem.len(). The resulting slice panics inside the FFI parser callback and aborts Suricata, enabling remote denial of service. Consume only the available tail and carry the remainder in to_skip_tc. Add the segmented-name regression from suricata-verify PR #3340; suricata-verify PR #3342 uses a single-segment 32-byte name with a 24-byte cap and does not exercise this crash.

@catenacyber catenacyber mentioned this pull request Sep 2, 2026
Closed
@catenacyber

catenacyber commented Sep 2, 2026

Copy link
Copy Markdown
Contributor Author

Replaced by #16164

@catenacyber catenacyber closed this Sep 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@jasonish jasonish Awaiting requested review from jasonish jasonish is a code owner
@jufajardini jufajardini Awaiting requested review from jufajardini jufajardini is a code owner

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@catenacyber @suricata-review-bot