Merge pull request #2652 in SNORT/snort3 from ~MDAGON/snort3:response_depth to master

Squashed commit of the following:

commit 96069fe351ed5344e37c0b4ca75866cd99e1bbc9
Author: mdagon <mdagon@cisco.com>
Date:   Fri Dec 4 12:08:47 2020 -0500

    http2_inspect: handle discard

diff --git a/src/service_inspectors/http2_inspect/http2_stream_splitter_impl.cc b/src/service_inspectors/http2_inspect/http2_stream_splitter_impl.cc
index c90d45ef2eac8a70caa49f806f8d5c621ac1d4da..b9aa6a129818228f65aaefaf99c84890fb4b87ec 100644 (file)
--- a/src/service_inspectors/http2_inspect/http2_stream_splitter_impl.cc
+++ b/src/service_inspectors/http2_inspect/http2_stream_splitter_impl.cc
@@ -501,9 +501,13 @@ const StreamBuffer Http2StreamSplitter::implement_reassemble(Http2FlowData* sess
             session_data->frame_reassemble[source_id] = nullptr;
         }
 
-        // Return 0-length non-null buffer to stream which signals detection required, but don't
-        // create pkt_data buffer
-        frame_buf.data = (const uint8_t*)"";
+        if (session_data->frame_type[source_id] != FT_DATA ||
+            session_data->frame_data[source_id] != nullptr)
+        {
+            // Return 0-length non-null buffer to stream which signals detection required,
+            // but don't create pkt_data buffer
+            frame_buf.data = (const uint8_t*)"";
+        }
     }
 
     return frame_buf;