From bf3c8687d43134fa2a95a8b22171c32c346a2da9 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 21 May 2026 09:39:04 +0200
Subject: [PATCH] fuzz: forbid usage of pcre with \X

Ticket: 8634
(cherry picked from commit 097975e289ca6ad5ff1246d6ded74b2580b9af4b)
---
 src/detect-pcre.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index f5481bd21f83..3c378bac1ba8 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -641,6 +641,21 @@ static DetectPcreData *DetectPcreParse (DetectEngineCtx *de_ctx,
     if (capture_names == NULL || strlen(capture_names) == 0)
         opts |= PCRE2_NO_AUTO_CAPTURE;
 
+#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+    // forbid use of \X Unicode extended grapheme cluster as slow
+    bool escape = false;
+    for (size_t i = 0; i < strlen(re); i++) {
+        if (escape) {
+            if (re[i] == 'X') {
+                goto error;
+            }
+            escape = false;
+        } else if (re[i] == '\\') {
+            escape = true;
+        }
+    }
+
+#endif
     pd->parse_regex.regex =
             pcre2_compile((PCRE2_SPTR8)re, PCRE2_ZERO_TERMINATED, opts, &en, &eo2, NULL);
     if (pd->parse_regex.regex == NULL && en == 115) { // reference to nonexistent subpattern