From b91ef71c0d898b6c1cfa818e4a08fff3932d657d Mon Sep 17 00:00:00 2001 From: Stephen Donnelly Date: Thu, 13 Aug 2026 13:57:45 +1200 Subject: [PATCH] dag: check rlen is a valid length Ticket: 8797 Add check to rlen value read from ERF record to avoid potential infinite loop, must be >= dag_record_length (16). Similar check exists in source_erf_file already. (cherry picked from commit a37b75a8ba040eb4a1d78a35e270752f2f2b9884) --- src/source-erf-dag.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/source-erf-dag.c b/src/source-erf-dag.c index 43acc4d2c359..f9ba7e08266f 100644 --- a/src/source-erf-dag.c +++ b/src/source-erf-dag.c @@ -403,6 +403,12 @@ ProcessErfDagRecords(ErfDagThreadVars *ewtn, uint8_t *top, uint32_t *pkts_read) rlen = SCNtohs(dr->rlen); hdr_type = dr->type; + if (rlen < dag_record_size) { + SCLogError("Bad ERF record length %d (< dag_record_size) on stream: %d, DAG: %s", rlen, + ewtn->dagstream, ewtn->dagname); + SCReturnInt(TM_ECODE_FAILED); + } + /* If we don't have enough data to finish processing this ERF * record return and maybe next time we will. */