pfSense » pfSense Plus

Packages and other scripts could use ini_set("pcre.jit", "0"); to disable PCRE JIT on systems without the patch to avoid the problem on unpatched systems until the next update.

Testing against the current 21.09 snapshot the disable-pcrejit patch is no longer required.

21.09-DEVELOPMENT (arm)
built on Thu Jul 22 01:10:26 EDT 2021
FreeBSD 12.2-STABLE

That patch is in that snapshot but after reverting it the following test code returns successfully.

$rule1 = 'alert ( msg:"DECODE_NOT_IPV4_DGRAM"; sid:1; gid:116; rev:1; metadata:rule-type decode; classtype:protocol-command-decode;)';

$matches = array();

if (preg_match('/\bmsg\s*:\s*"(.+?)"\s*;/i', $rule1, $matches))
      $msg = trim($matches[1]);
if (preg_match('/\bsid\s*:\s*(\d+)\s*;/i', $rule1, $matches))
      $sid = trim($matches[1]);
if (preg_match('/\bgid\s*:\s*(\d+)\s*;/i', $rule1, $matches))
      $gid = trim($matches[1]);
if (preg_match('/\brev\s*:\s*([^\;]+)/i', $rule1, $matches))
      $rev = trim($matches[1]);
if (preg_match('/\bclasstype\s*:\s*([^\;]+)/i', $rule1, $matches))
      $classtype = trim($matches[1]);

print $msg . "\n";
print $sid . "\n";
print $gid . "\n";
print $rev . "\n";
print $classtype . "\n";

That code coredumps PHP in 21.05 without the patch.

I reverted the relevant commits since this is no longer necessary.