detect/frame: improve assert accuracy

Handle frames of unknown size correctly.

Bug: #5226.

diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c
index 330b0840681ae4bcdfa0586702c822f5c184cabd..6aeda8048f5836cf90d38d78f82670927885b82b 100644 (file)
--- a/src/detect-engine-frame.c
+++ b/src/detect-engine-frame.c
@@ -384,7 +384,7 @@ int DetectEngineInspectFrameBufferGeneric(DetectEngineThreadCtx *det_ctx,
     // PrintRawDataFp(stdout, data, data_len);
     // PrintRawDataFp(stdout, data, MIN(64, data_len));
 #endif
-    BUG_ON((int64_t)data_len > frame->len);
+    BUG_ON(frame->len > 0 && (int64_t)data_len > frame->len);
 
     // TODO don't call if matching needs frame end and DETECT_CI_FLAGS_END not set
     // TODO same for start