[meta-security,scarthgap] suricata: fix CVE-2024-45795 & CVE-2024-45796

diff --git a/recipes-ids/suricata/files/CVE-2024-45795.patch b/recipes-ids/suricata/files/CVE-2024-45795.patch
new file mode 100644
index 0000000..10363c5
--- /dev/null
+++ b/recipes-ids/suricata/files/CVE-2024-45795.patch
@@ -0,0 +1,123 @@ 
+From 72456d359bf3064306b62024c809bb30b162f18c Mon Sep 17 00:00:00 2001
+From: Philippe Antoine <pantoine@oisf.net>
+Date: Mon, 12 Aug 2024 09:54:43 +0200
+Subject: [PATCH] detect/datasets: implement unset command
+
+Ticket: 7195
+
+Otherwise, Suricata aborted on such a rule
+
+(cherry picked from commit e47598110a557bb9f87ea498d85ba91a45bb0cb6)
+
+Upstream-Status: Backport [https://github.com/OISF/suricata/commit/72456d359bf3064306b62024c809bb30b162f18c && https://github.com/OISF/suricata/commit/96d5c81aed01f2bc0cd3e2e60057d0deb38caa99]
+CVE: CVE-2024-45795
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ doc/userguide/rules/datasets.rst |  2 +-
+ src/datasets.c                   | 20 ++++++++++++++++++++
+ src/datasets.h                   |  1 +
+ src/detect-dataset.c             | 11 +++++++++++
+ src/detect-dataset.h             |  5 -----
+ 5 files changed, 33 insertions(+), 6 deletions(-)
+
+diff --git a/doc/userguide/rules/datasets.rst b/doc/userguide/rules/datasets.rst
+index 647b12e..dd9ecd2 100644
+--- a/doc/userguide/rules/datasets.rst
++++ b/doc/userguide/rules/datasets.rst
+@@ -78,7 +78,7 @@ Syntax::
+ 
+     dataset:<cmd>,<name>,<options>;
+ 
+-    dataset:<set|isset|isnotset>,<name> \
++    dataset:<set|unset|isset|isnotset>,<name> \
+         [, type <string|md5|sha256|ipv4|ip>, save <file name>, load <file name>, state <file name>, memcap <size>, hashsize <size>];
+ 
+ type <type>
+diff --git a/src/datasets.c b/src/datasets.c
+index d89ed8d..32bcf6e 100644
+--- a/src/datasets.c
++++ b/src/datasets.c
+@@ -1741,3 +1741,23 @@ int DatasetRemoveSerialized(Dataset *set, const char *string)
+     return DatasetOpSerialized(set, string, DatasetRemoveString, DatasetRemoveMd5,
+             DatasetRemoveSha256, DatasetRemoveIPv4, DatasetRemoveIPv6);
+ }
++
++int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len)
++{
++    if (set == NULL)
++        return -1;
++
++    switch (set->type) {
++        case DATASET_TYPE_STRING:
++            return DatasetRemoveString(set, data, data_len);
++        case DATASET_TYPE_MD5:
++            return DatasetRemoveMd5(set, data, data_len);
++        case DATASET_TYPE_SHA256:
++            return DatasetRemoveSha256(set, data, data_len);
++        case DATASET_TYPE_IPV4:
++            return DatasetRemoveIPv4(set, data, data_len);
++        case DATASET_TYPE_IPV6:
++            return DatasetRemoveIPv6(set, data, data_len);
++    }
++    return -1;
++}
+diff --git a/src/datasets.h b/src/datasets.h
+index af4fc17..0f28a9f 100644
+--- a/src/datasets.h
++++ b/src/datasets.h
+@@ -56,6 +56,7 @@ Dataset *DatasetFind(const char *name, enum DatasetTypes type);
+ Dataset *DatasetGet(const char *name, enum DatasetTypes type, const char *save, const char *load,
+         uint64_t memcap, uint32_t hashsize);
+ int DatasetAdd(Dataset *set, const uint8_t *data, const uint32_t data_len);
++int DatasetRemove(Dataset *set, const uint8_t *data, const uint32_t data_len);
+ int DatasetLookup(Dataset *set, const uint8_t *data, const uint32_t data_len);
+ DataRepResultType DatasetLookupwRep(Dataset *set, const uint8_t *data, const uint32_t data_len,
+         const DataRepType *rep);
+diff --git a/src/detect-dataset.c b/src/detect-dataset.c
+index 3d29646..aad5cf0 100644
+--- a/src/detect-dataset.c
++++ b/src/detect-dataset.c
+@@ -41,6 +41,11 @@
+ #include "util-path.h"
+ #include "util-conf.h"
+ 
++#define DETECT_DATASET_CMD_SET      0
++#define DETECT_DATASET_CMD_UNSET    1
++#define DETECT_DATASET_CMD_ISNOTSET 2
++#define DETECT_DATASET_CMD_ISSET    3
++
+ int DetectDatasetMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *,
+         const Signature *, const SigMatchCtx *);
+ static int DetectDatasetSetup (DetectEngineCtx *, Signature *, const char *);
+@@ -91,6 +96,12 @@ int DetectDatasetBufferMatch(DetectEngineThreadCtx *det_ctx,
+                 return 1;
+             break;
+         }
++        case DETECT_DATASET_CMD_UNSET: {
++            int r = DatasetRemove(sd->set, data, data_len);
++            if (r == 1)
++                return 1;
++            break;
++        }
+         default:
+             abort();
+     }
+diff --git a/src/detect-dataset.h b/src/detect-dataset.h
+index ca83267..d243552 100644
+--- a/src/detect-dataset.h
++++ b/src/detect-dataset.h
+@@ -26,11 +26,6 @@
+ 
+ #include "datasets.h"
+ 
+-#define DETECT_DATASET_CMD_SET      0
+-#define DETECT_DATASET_CMD_UNSET    1
+-#define DETECT_DATASET_CMD_ISNOTSET 2
+-#define DETECT_DATASET_CMD_ISSET    3
+-
+ typedef struct DetectDatasetData_ {
+     Dataset *set;
+     uint8_t cmd;
+-- 
+2.25.1
+
diff --git a/recipes-ids/suricata/files/CVE-2024-45796.patch b/recipes-ids/suricata/files/CVE-2024-45796.patch
new file mode 100644
index 0000000..ae00a5f
--- /dev/null
+++ b/recipes-ids/suricata/files/CVE-2024-45796.patch
@@ -0,0 +1,33 @@ 
+From 9203656496c4081260817cce018a0d8fd57869b5 Mon Sep 17 00:00:00 2001
+From: Philippe Antoine <pantoine@oisf.net>
+Date: Mon, 15 Jul 2024 09:52:00 +0200
+Subject: [PATCH] defrag: fix off by one
+
+Ticket: 7067
+
+This off by one could lead to an empty fragment being inserted
+in the rb tree, which led to integer underflow.
+
+Upstream-Status: Backport [https://github.com/OISF/suricata/commit/9203656496c4081260817cce018a0d8fd57869b5]
+CVE: CVE-2024-45796
+Signed-off-by: Hitendra Prajapati <hprajapati@mvista.com>
+---
+ src/defrag.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/defrag.c b/src/defrag.c
+index 71cf420..38704c9 100644
+--- a/src/defrag.c
++++ b/src/defrag.c
+@@ -808,7 +808,7 @@ DefragInsertFrag(ThreadVars *tv, DecodeThreadVars *dtv, DefragTracker *tracker,
+         }
+     }
+ 
+-    if (ltrim > data_len) {
++    if (ltrim >= data_len) {
+         /* Full packet has been trimmed due to the overlap policy. Overlap
+          * already set. */
+         goto done;
+-- 
+2.25.1
+
diff --git a/recipes-ids/suricata/suricata_7.0.0.bb b/recipes-ids/suricata/suricata_7.0.0.bb
index a01b3d9..e5d6ed1 100644
--- a/recipes-ids/suricata/suricata_7.0.0.bb
+++ b/recipes-ids/suricata/suricata_7.0.0.bb
@@ -16,6 +16,8 @@  SRC_URI += " \
     file://suricata.service \
     file://run-ptest \
     file://fixup.patch \
+    file://CVE-2024-45795.patch \
+    file://CVE-2024-45796.patch \
     "
 
 inherit autotools pkgconfig python3native systemd ptest cargo cargo-update-recipe-crates