From: Victor Julien <victor@inliniac.net>
Date: Thu, 30 Aug 2018 13:03:34 +0000 (+0200)
Subject: stream: expand GAP detection
X-Git-Tag: suricata-4.0.6~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=076c02a223b08b44ae76914b236db2577160d62a;p=thirdparty%2Fsuricata.git

stream: expand GAP detection
---

diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c
index e249d729d0..1e782199ff 100644
--- a/src/stream-tcp-reassemble.c
+++ b/src/stream-tcp-reassemble.c
@@ -886,7 +886,18 @@ static void GetAppBuffer(TcpStream *stream, const uint8_t **data, uint32_t *data
             *data = NULL;
             *data_len = blk->offset - offset;
 
-        } else if (offset > blk->offset && offset <= (blk->offset + blk->len)) {
+        } else if (offset >= (blk->offset + blk->len)) {
+
+            *data = NULL;
+            StreamingBufferBlock *nblk = blk->next;
+            *data_len = nblk ? nblk->offset - offset : 0;
+            if (nblk) {
+                SCLogDebug("gap, want data at offset %"PRIu64", "
+                        "got data at %"PRIu64". GAP of size %"PRIu64,
+                        offset, nblk->offset, nblk->offset - offset);
+            }
+
+        } else if (offset > blk->offset && offset < (blk->offset + blk->len)) {
             SCLogDebug("get data from offset %"PRIu64". SBB %"PRIu64"/%u",
                     offset, blk->offset, blk->len);
             StreamingBufferSBBGetDataAtOffset(&stream->sb, blk, data, data_len, offset);