stream/tcp: fix STREAM_HAS_SEEN_DATA macro

The macro would not return true for smaller TCP streams, leading to
cases where the app-layer was not notified of EOF.

(cherry picked from commit e500c59b994ef2c4ba1c2bd17b4d4ff674a144ef)

diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h
index b6d2244cd89dfcac319d52b59606de9f6f7ae023..e706f86c8c25b5e45e8f198a4a2d49f77093b0c6 100644 (file)
--- a/src/stream-tcp-private.h
+++ b/src/stream-tcp-private.h
@@ -89,7 +89,7 @@ RB_PROTOTYPE(TCPSEG, TcpSegment, rb, TcpSegmentCompare);
 #define STREAM_SEQ_RIGHT_EDGE(stream)   (stream)->segs_right_edge
 #define STREAM_RIGHT_EDGE(stream)       (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq))
 /* return true if we have seen data segments. */
-#define STREAM_HAS_SEEN_DATA(stream)    (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset)
+#define STREAM_HAS_SEEN_DATA(stream)    (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset || (stream)->sb.buf_offset)
 
 typedef struct TcpStream_ {
     uint16_t flags:12;              /**< Flag specific to the stream e.g. Timestamp */