smtp: consider file state in file_data inspection limits

diff --git a/src/detect-engine-filedata-smtp.c b/src/detect-engine-filedata-smtp.c
index 829832f9dc70fde082c2b6004c479c5b4e02d0e2..2af1fe0dd2370c5679beac1fa554a6c82899ba1f 100644 (file)
--- a/src/detect-engine-filedata-smtp.c
+++ b/src/detect-engine-filedata-smtp.c
@@ -137,7 +137,7 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
     if ((smtp_config.content_limit == 0 ||
          curr_file->content_len_so_far < smtp_config.content_limit) &&
         curr_file->content_len_so_far < smtp_config.content_inspect_min_size &&
-        !(flags & STREAM_EOF)) {
+        !(flags & STREAM_EOF) && !(curr_file->state > FILE_STATE_OPENED)) {
         SCLogDebug("we still haven't seen the entire content. "
                    "Let's defer content inspection till we see the "
                    "entire content.");