Skip to content

detect: fail thread init on keyword ctx error - #15588

Closed
ssam18 wants to merge 1 commit into
OISF:mainfrom
ssam18:filemagic-threadinit-fail-8237-v1
Closed

detect: fail thread init on keyword ctx error#15588
ssam18 wants to merge 1 commit into
OISF:mainfrom
ssam18:filemagic-threadinit-fail-8237-v1

Conversation

@ssam18

@ssam18 ssam18 commented Jun 9, 2026

Copy link
Copy Markdown
Contributor

Contribution style:

Our Contribution agreements:

Changes (if applicable):

Link to ticket: https://redmine.openinfosecfoundation.org/issues/8237

Describe changes:

  • ThreadCtxDoInit called DetectEngineThreadCtxInitKeywords but ignored its return value. When a per-thread keyword init fails (for example DetectFilemagicThreadInit returning NULL), the keyword context array was left partially initialized and the detect thread kept running, giving indeterminate results.
  • Propagate the failure from DetectEngineThreadCtxInitKeywords so ThreadCtxDoInit returns TM_ECODE_FAILED. The existing callers already deinit and fail thread init on that, so the thread now aborts cleanly instead of running degraded.
  • Added a unit test that registers a keyword whose per-thread init returns NULL and verifies DetectEngineThreadCtxInit reports failure. Confirmed the test fails without the fix and passes with it, and the full DetectEngine unit test group still passes.

DetectEngineThreadCtxInitKeywords returns TM_ECODE_FAILED when a
per-thread keyword init fails (for example DetectFilemagicThreadInit),
but ThreadCtxDoInit discarded that result and still returned OK. The
detect thread then ran with a partially initialized keyword context
array, producing indeterminate results. Propagate the failure so the
callers abort thread init and clean up.

Add a unit test that registers a keyword whose thread init fails and
verifies that DetectEngineThreadCtxInit reports the failure.
Ticket: OISF#8237
@ssam18

ssam18 commented Jun 9, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #15589, which keeps this keyword-init fix (Ticket #8237) and also carries the cbindgen/bytemath build fix needed to get CI green. Closing in favor of that one.

@ssam18 ssam18 closed this Jun 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

1 participant