fix bug in SSLParser

[focksor]

Make sure these boxes are signed before submitting your Pull Request -- thank you.

• I have read the contributing guide lines at https://suricata.readthedocs.io/en/latest/devguide/codebase/contributing/contribution-process.html
• I have signed the Open Information Security Foundation contribution agreement at https://suricata.io/about/contribution-agreement/
• I have updated the user guide (in doc/userguide/) to reflect the changes made (if applicable)

Link to redmine ticket: https://redmine.openinfosecfoundation.org/issues/5767

Describe changes:

• When pass a JA3Buffer *ja3_elliptic_curves into function TLSDecodeHSHelloExtensionEllipticCurves, the buffer may be freed by Ja3BufferAddValue and set to NULL. But the raw pointer of the buffer will not change in this case.
• The same thing also happened in function TLSDecodeHSHelloExtensionEllipticCurvePF

#suricata-verify-pr:
#suricata-verify-repo:
#suricata-verify-branch:
#suricata-update-pr:
#suricata-update-repo:
#suricata-update-branch:
#libhtp-pr:
#libhtp-repo:
#libhtp-branch:

[jufajardini]

Hello, thanks for this contribution :)
Is there a redmine ticket for this bug? If not, could you create one, please?

[focksor]

added ticket

[catenacyber]

Thanks @focksor

This looks legit... Quick remarks :
Would you have a test case for this ? Like a suricata-verify test ?
Could you get the CI green ?
Let me know if you have questions about this...
See https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Contributing

[catenacyber]

Why did you close this ? Are you opening a new PR ?

[focksor]

sorry, i'm not a professional developer of suricate and i don't know how to create a test case. i just read the code and happened to find out there is a bug. i think maybe i'm wasting your time because i cannot give you more information about this bug. that's the reason why i closed this pull request.

[catenacyber]

sorry, i'm not a professional developer of suricate and i don't know how to create a test case.

You can take a look at https://github.com/OISF/suricata-verify

i just read the code and happened to find out there is a bug. i think maybe i'm wasting your time because i cannot give you more information about this bug. that's the reason why i closed this pull request.

How does the bug manifest ?
Is there a set fault ? a miscalculated ja3 ?

[focksor]

it obviously will cause a segment fault because of the dangling pointer

[catenacyber]

Ok, I see the bug. It happens if realloc fails...
Could the fix rather be to have Ja3BufferAddValue use a JA3Buffer *buffer as argument and not call Ja3BufferFree in case of failure ?..