Skip to content

Sagan faults with large input and certain pcre rules. #122

@beave

Description

@beave

Describe the bug

libpcre faults when dealing with certain types of expressions. For example:

pcre: "/^((?!Account Name: (.)$ ).)$/";

Will work fine with smaller strings, but fault on large input. This was encountered when on sid 500343.

To Reproduce
Steps to reproduce the behavior:

  1. Enabled rule with the pcre above.
  2. using "logger" and "seq" send a large string.
  3. Sagan gets a fault

See this link for a similar described problem. This likely is a recursive limitation issue in the "match" function of PCRE. Non-JIT causes a crash, while JIT causes a miss (no match / falsely)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions