]> git.ipfire.org Git - thirdparty/suricata.git/commitdiff
stream: harden data size handling
authorVictor Julien <victor@inliniac.net>
Wed, 21 Oct 2020 18:22:50 +0000 (20:22 +0200)
committerVictor Julien <victor@inliniac.net>
Wed, 4 Nov 2020 15:30:17 +0000 (16:30 +0100)
Handle edge cases around ACKs and last_ack getting below
'app_progress', which can happen during shutdown of a flow
with multiple GAPs.

src/stream-tcp-reassemble.c

index 006d908455247af15b94e50c736eb3d910c3ebb3..6b3ace4f176ea044e4aefd4a6af2bdaf3c2d2a38 100644 (file)
@@ -1057,9 +1057,10 @@ static inline uint32_t AdjustToAcked(const Packet *p,
                 /* get max absolute offset */
                 last_ack_abs += delta;
             }
+            DEBUG_VALIDATE_BUG_ON(app_progress > last_ack_abs);
 
             /* see if the buffer contains unack'd data as well */
-            if (app_progress + data_len > last_ack_abs) {
+            if (app_progress <= last_ack_abs && app_progress + data_len > last_ack_abs) {
                 uint32_t check = data_len;
                 adjusted = last_ack_abs - app_progress;
                 BUG_ON(adjusted > check);