[Oisf-devel] [COMMIT] OISF branch, master, updated. suricata-3.0-98-g5dbedbf

OISF Git noreply at openinfosecfoundation.org
Thu Mar 3 07:48:21 UTC 2016


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "OISF".

The branch, master has been updated
       via  5dbedbfa5bacf8a02459b2389596b63ec7822aa0 (commit)
       via  10e2e2a8b6e5ffabcbc85708c57627dc0be7e087 (commit)
       via  50ad1ce3071a4bfd428db4992f4f5e5a92ec9424 (commit)
       via  a2ceb98064ad4486334b6bd85a7da9abcfaf0730 (commit)
       via  83f400dd60d7701aabee2336046e845f553f848d (commit)
       via  6e3514a4449f3c274f82aa08b5a4e0e5272fa55e (commit)
       via  914f7fa73384f74b0207284052d5bf130724d6f9 (commit)
       via  6b942b6734639d249185433541d76c8141779aa7 (commit)
       via  e3703ee1262f327f2f25afdfb6538095a734c189 (commit)
       via  8631b73852b675048ef4b54f7a47d8792610c9e9 (commit)
       via  77f67062dedf40b66773a9a9d7d679536c6e1c6c (commit)
       via  a1a0acf8a8437cbc8c397cbea871f360ec5e9237 (commit)
       via  dddd2d06f6ada5fd2edd689673ed217c833df516 (commit)
       via  1efcaf217904b3b2238684a6437d2afb0dec08bf (commit)
       via  27f6620874b418d7cd5ba43b9852ce0b023435b9 (commit)
      from  881fc5500d4f467b55000c4dbd0384ec66e62847 (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 5dbedbfa5bacf8a02459b2389596b63ec7822aa0
Author: Eric Leblond <eric at regit.org>
Date:   Tue Mar 1 14:59:13 2016 +0100

    app-layer-smtp: fix memory leak
    
    This patch fixes the following leak:
    
    Direct leak of 9982880 byte(s) in 2902 object(s) allocated from:
        #0 0x4c253b in malloc ??:?
        #1 0x10c39ac in MimeDecInitParser /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/util-decode-mime.c:2379
        #2 0x6a0f91 in SMTPProcessRequest /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1085
        #3 0x697658 in SMTPParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1185
        #4 0x68fa7a in SMTPParseClientRecord /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-smtp.c:1208
        #5 0x6561c5 in AppLayerParserParse /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer-parser.c:908
        #6 0x53dc2e in AppLayerHandleTCPData /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/app-layer.c:444
        #7 0xf8e0af in DoReassemble /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:2635
        #8 0xf8c3f8 in StreamTcpReassembleAppLayer /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3028
        #9 0xf94267 in StreamTcpReassembleHandleSegmentUpdateACK /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3404
        #10 0xf9643d in StreamTcpReassembleHandleSegment /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp-reassemble.c:3432
        #11 0xf578b4 in HandleEstablishedPacketToClient /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2245
        #12 0xeea3c7 in StreamTcpPacketStateEstablished /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:2489
        #13 0xec1d38 in StreamTcpPacket /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:4568
        #14 0xeb0e16 in StreamTcp /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/stream-tcp.c:5064
        #15 0xff52a4 in TmThreadsSlotVarRun /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:130
        #16 0xffdad1 in TmThreadsSlotVar /home/victor/qa/buildbot/donkey/z600fuzz/Private/src/tm-threads.c:474
        #17 0x7f7cd678d181 in start_thread /build/buildd/eglibc-2.19/nptl/pthread_create.c:312 (discriminator 2)
    
    We come to this case when a SMTP session contains at least 2 mails
    and then the ending of the first is not correctly detected. In that
    case, switching to a new tx seems a good solution. This way we still
    have partial logging.

commit 10e2e2a8b6e5ffabcbc85708c57627dc0be7e087
Author: Eric Leblond <eric at regit.org>
Date:   Tue Mar 1 15:44:27 2016 +0100

    app-layer-smtp: fix mem leak and add new alert
    
    If SMTP session is weird then we may reach a state where a field
    like MAIL FROM is seen as duplicated.
    
    Valgrind output is:
    
    30 bytes in 1 blocks are definitely lost in loss record 96 of 399
       at 0x4C29C0F: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
       by 0x4A5803: SMTPParseCommandWithParam (app-layer-smtp.c:996)
       by 0x4A4DCE: SMTPParseCommandMAILFROM (app-layer-smtp.c:1016)
       by 0x4A3F55: SMTPProcessRequest (app-layer-smtp.c:1127)
       by 0x4A1F8C: SMTPParse (app-layer-smtp.c:1191)
       by 0x493AD7: SMTPParseClientRecord (app-layer-smtp.c:1214)
       by 0x4878A6: AppLayerParserParse (app-layer-parser.c:908)
       by 0x42384E: AppLayerHandleTCPData (app-layer.c:444)
       by 0x8D7EAD: DoReassemble (stream-tcp-reassemble.c:2635)
       by 0x8D795F: StreamTcpReassembleAppLayer (stream-tcp-reassemble.c:3028)
       by 0x8D8BE0: StreamTcpReassembleHandleSegmentUpdateACK (stream-tcp-reassemble.c:3404)
       by 0x8D8F6E: StreamTcpReassembleHandleSegment (stream-tcp-reassemble.c:3432)

commit 50ad1ce3071a4bfd428db4992f4f5e5a92ec9424
Author: Eric Leblond <eric at regit.org>
Date:   Tue Mar 1 09:12:53 2016 +0100

    build: install app-layer-events.rules

commit a2ceb98064ad4486334b6bd85a7da9abcfaf0730
Author: Victor Julien <victor at inliniac.net>
Date:   Mon Dec 14 18:27:09 2015 +0100

    file: fix flags type in API

commit 83f400dd60d7701aabee2336046e845f553f848d
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 23:26:07 2015 +0100

    http: remove unused param from HtpBodyAppendChunk

commit 6e3514a4449f3c274f82aa08b5a4e0e5272fa55e
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 07:55:44 2015 +0100

    spm: constify search args

commit 914f7fa73384f74b0207284052d5bf130724d6f9
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 10:33:21 2015 +0100

    file: shrink data structure

commit 6b942b6734639d249185433541d76c8141779aa7
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 07:58:15 2015 +0100

    htp file: constify name/data args

commit e3703ee1262f327f2f25afdfb6538095a734c189
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 07:56:36 2015 +0100

    file: constify data/name args

commit 8631b73852b675048ef4b54f7a47d8792610c9e9
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 22:53:55 2015 +0100

    http body: use HTPCalloc

commit 77f67062dedf40b66773a9a9d7d679536c6e1c6c
Author: Victor Julien <victor at inliniac.net>
Date:   Fri Nov 13 17:11:08 2015 +0100

    htp: add HTPCalloc wrapper

commit a1a0acf8a8437cbc8c397cbea871f360ec5e9237
Author: Victor Julien <victor at inliniac.net>
Date:   Mon Nov 30 21:20:59 2015 +0100

    magic: make data arg const

commit dddd2d06f6ada5fd2edd689673ed217c833df516
Author: Jason Ish <ish at unx.ca>
Date:   Tue Mar 1 15:08:14 2016 -0600

    dcerpc: cleanup list handling

commit 1efcaf217904b3b2238684a6437d2afb0dec08bf
Author: Jason Ish <ish at unx.ca>
Date:   Tue Mar 1 14:36:17 2016 -0600

    dcerpc: fix memory leak when called from smb
    
    When DCERPC was wrapped in SMB it wasn't being initialized or
    cleaned up properly. To fix, expose DCERPC initialization and
    cleanup functions for use by the SMB application layer.
    
    Redmine ticket:
    https://redmine.openinfosecfoundation.org/issues/1708

commit 27f6620874b418d7cd5ba43b9852ce0b023435b9
Author: Andreas Herz <andi at geekosphere.org>
Date:   Mon Feb 29 22:37:24 2016 +0100

    rule-parsing: quick fix for rules with wrong double quotes
    
    The stripping of leading and trailing "s has issues with rules like the
    ones described in issue 1638 thus resulted in crashing the rule parser.
    So for now this is a quick fix which approaches this issue directly by
    stripping those "s correctly and handling error cases. It also adds the
    skip for leading spaces at the msg keyword and worksaround a possible
    null pointer dereference (that should never occur though).
    A more general approach should be done in the future.

-----------------------------------------------------------------------

Summary of changes:
 Makefile.am                   |  1 +
 rules/smtp-events.rules       |  4 +-
 src/app-layer-dcerpc-common.h |  6 ++-
 src/app-layer-dcerpc.c        | 86 +++++++++++++++++++++----------------------
 src/app-layer-dcerpc.h        |  2 +
 src/app-layer-htp-body.c      | 14 +++----
 src/app-layer-htp-body.h      |  2 +-
 src/app-layer-htp-file.c      |  9 +++--
 src/app-layer-htp-file.h      |  6 +--
 src/app-layer-htp-mem.c       | 17 +++++++++
 src/app-layer-htp-mem.h       |  1 +
 src/app-layer-htp.c           |  8 ++--
 src/app-layer-smb.c           | 23 ++----------
 src/app-layer-smtp.c          | 26 +++++++++++++
 src/app-layer-smtp.h          |  4 ++
 src/detect-depth.c            |  8 ++--
 src/detect-distance.c         |  8 ++--
 src/detect-l3proto.c          |  8 ++--
 src/detect-msg.c              | 28 ++++++++------
 src/detect-offset.c           |  8 ++--
 src/detect-rev.c              |  9 +++--
 src/detect-within.c           |  8 ++--
 src/util-file.c               | 18 ++++-----
 src/util-file.h               | 13 ++++---
 src/util-magic.c              |  4 +-
 src/util-magic.h              |  4 +-
 src/util-memcpy.h             |  2 +-
 src/util-spm-bm.c             | 10 ++---
 src/util-spm-bm.h             |  6 +--
 src/util-spm.c                | 12 ++++--
 src/util-spm.h                |  8 ++--
 31 files changed, 209 insertions(+), 154 deletions(-)


hooks/post-receive
-- 
OISF


More information about the Oisf-devel mailing list