Describe the bug
libpcre faults when dealing with certain types of expressions. For example:
pcre: "/^((?!Account Name: (.)$ ).)$/";
Will work fine with smaller strings, but fault on large input. This was encountered when on sid 500343.
To Reproduce
Steps to reproduce the behavior:
- Enabled rule with the pcre above.
- using "logger" and "seq" send a large string.
- Sagan gets a fault
See this link for a similar described problem. This likely is a recursive limitation issue in the "match" function of PCRE. Non-JIT causes a crash, while JIT causes a miss (no match / falsely)