Backport8 8464 8624 8662 8663 v1

src/app-layer-ftp.c

@@ -648,6 +648,10 @@ static AppLayerResult FTPParseResponse(Flow *f, void *ftp_state, AppLayerParserS
         FTPTransaction *tx = FTPGetOldestTx(state, lasttx);
         if (tx == NULL) {
             tx = FTPTransactionCreate(state);
+            if (tx != NULL) {
+                /* This is a TC only transaction, skip TS inspection. */
+                tx->tx_data.flags |= APP_LAYER_TX_SKIP_INSPECT_TS;
+            }
         }
         if (unlikely(tx == NULL)) {
             SCReturnStruct(APP_LAYER_ERROR);

src/datasets-context-json.c

@@ -419,6 +419,10 @@ static uint32_t DatajsonAddStringElement(Dataset *set, json_t *value, char *json
     }
 
     *found = true;
+    if (!json_is_string(key)) {
+        FatalErrorOnInit("dataset: %s failed to get value because it is not a string", set->name);
+        return 0;
+    }
 
     const char *val_key = json_string_value(key);
     if (val_key == NULL) {
@@ -467,6 +471,10 @@ static uint32_t DatajsonAddMd5Element(Dataset *set, json_t *value, char *json_ke
 
     *found = true;
 
+    if (!json_is_string(key)) {
+        FatalErrorOnInit("dataset: %s failed to get value because it is not a string", set->name);
+        return 0;
+    }
     const char *hash_string = json_string_value(key);
     if (strlen(hash_string) != SC_MD5_HEX_LEN) {
         FatalErrorOnInit("Not correct length for a hash");
@@ -511,6 +519,10 @@ static uint32_t DatajsonAddSha256Element(Dataset *set, json_t *value, char *json
 
     *found = true;
 
+    if (!json_is_string(key)) {
+        FatalErrorOnInit("dataset: %s failed to get value because it is not a string", set->name);
+        return 0;
+    }
     const char *hash_string = json_string_value(key);
     if (strlen(hash_string) != SC_SHA256_HEX_LEN) {
         FatalErrorOnInit("Not correct length for a hash");
@@ -556,6 +568,10 @@ static uint32_t DatajsonAddIpv4Element(Dataset *set, json_t *value, char *json_k
 
     *found = true;
 
+    if (!json_is_string(key)) {
+        FatalErrorOnInit("dataset: %s failed to get value because it is not a string", set->name);
+        return 0;
+    }
     const char *ip_string = json_string_value(key);
     struct in_addr in;
     if (inet_pton(AF_INET, ip_string, &in) != 1) {
@@ -596,6 +612,10 @@ static uint32_t DatajsonAddIPv6Element(Dataset *set, json_t *value, char *json_k
 
     *found = true;
 
+    if (!json_is_string(key)) {
+        FatalErrorOnInit("dataset: %s failed to get value because it is not a string", set->name);
+        return 0;
+    }
     const char *ip_string = json_string_value(key);
     struct in6_addr in6;
     int ret = DatasetParseIpv6String(set, ip_string, &in6);

src/detect-engine.c

@@ -3467,8 +3467,8 @@ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *
     }
     det_ctx->multi_inspect.to_clear_idx = 0;
 
-
-    DetectEngineThreadCtxInitKeywords(de_ctx, det_ctx);
+    if (DetectEngineThreadCtxInitKeywords(de_ctx, det_ctx) != TM_ECODE_OK)
+        return TM_ECODE_FAILED;
     DetectEngineThreadCtxInitGlobalKeywords(det_ctx);
 #ifdef PROFILE_RULES
     SCProfilingRuleThreadSetup(de_ctx->profile_ctx, det_ctx);
@@ -5433,6 +5433,52 @@ static int DetectEngineTest09(void)
     PASS;
 }
 
+/** \brief keyword thread-context init stub that always fails, used to mimic a
+ *  failing per-thread keyword init such as DetectFilemagicThreadInit. */
+static void *DetectEngineFailingThreadKeywordInit(void *data)
+{
+    (void)data;
+    return NULL;
+}
+
+static void DetectEngineNoopThreadKeywordFree(void *ctx)
+{
+    (void)ctx;
+}
+
+/** \test Ticket #8237: a failing per-thread keyword init must make the detect
+ *  thread context init fail rather than silently continuing with a partially
+ *  initialized keyword context array. */
+static int DetectEngineThreadCtxInitKeywordFailTest(void)
+{
+    ThreadVars th_v;
+    memset(&th_v, 0, sizeof(th_v));
+    DetectEngineThreadCtx *det_ctx = NULL;
+
+    DetectEngineCtx *de_ctx = DetectEngineCtxInit();
+    FAIL_IF_NULL(de_ctx);
+    de_ctx->flags |= DE_QUIET;
+
+    Signature *s = DetectEngineAppendSig(de_ctx, "alert tcp any any -> any any (sid:1;)");
+    FAIL_IF_NULL(s);
+
+    SigGroupBuild(de_ctx);
+
+    /* Register a keyword whose per-thread init fails (returns NULL). */
+    int id = DetectRegisterThreadCtxFuncs(de_ctx, "test_failing_keyword",
+            DetectEngineFailingThreadKeywordInit, NULL, DetectEngineNoopThreadKeywordFree, 0);
+    FAIL_IF(id < 0);
+
+    /* Thread context init must report failure and not hand back a context. */
+    TmEcode r = DetectEngineThreadCtxInit(&th_v, (void *)de_ctx, (void *)&det_ctx);
+    FAIL_IF(r != TM_ECODE_FAILED);
+    FAIL_IF_NOT_NULL(det_ctx);
+
+    DetectEngineCtxFree(de_ctx);
+
+    PASS;
+}
+
 #endif
 
 void DetectEngineRegisterTests(void)
@@ -5444,5 +5490,7 @@ void DetectEngineRegisterTests(void)
     UtRegisterTest("DetectEngineTest04", DetectEngineTest04);
     UtRegisterTest("DetectEngineTest08", DetectEngineTest08);
     UtRegisterTest("DetectEngineTest09", DetectEngineTest09);
+    UtRegisterTest(
+            "DetectEngineThreadCtxInitKeywordFailTest", DetectEngineThreadCtxInitKeywordFailTest);
 #endif
 }

src/detect-ftpdata.c

@@ -105,17 +105,7 @@ static int DetectFtpdataMatch(DetectEngineThreadCtx *det_ctx,
     if (ftp_state == NULL)
         return 0;
 
-    if (ftpcommandd->command == ftp_state->command) {
-        /* Only match if the flow is in the good direction */
-        if ((flags & STREAM_TOSERVER) && (ftpcommandd->command == FTP_COMMAND_RETR)) {
-            return 0;
-        } else if ((flags & STREAM_TOCLIENT) && (ftpcommandd->command == FTP_COMMAND_STOR)) {
-            return 0;
-        }
-        return 1;
-    }
-
-    return 0;
+    return ftpcommandd->command == ftp_state->command;
 }
 
 /**