From: Victor Julien <victor@inliniac.net>
Date: Tue, 24 Mar 2020 12:11:03 +0000 (+0100)
Subject: stream/tcp: fix STREAM_HAS_SEEN_DATA macro
X-Git-Tag: suricata-5.0.3~80
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=27b6fada2835faa9259df1c2441d81b71a668ae9;p=thirdparty%2Fsuricata.git

stream/tcp: fix STREAM_HAS_SEEN_DATA macro

The macro would not return true for smaller TCP streams, leading to
cases where the app-layer was not notified of EOF.

(cherry picked from commit e500c59b994ef2c4ba1c2bd17b4d4ff674a144ef)
---

diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h
index b6d2244cd8..e706f86c8c 100644
--- a/src/stream-tcp-private.h
+++ b/src/stream-tcp-private.h
@@ -89,7 +89,7 @@ RB_PROTOTYPE(TCPSEG, TcpSegment, rb, TcpSegmentCompare);
 #define STREAM_SEQ_RIGHT_EDGE(stream)   (stream)->segs_right_edge
 #define STREAM_RIGHT_EDGE(stream)       (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq))
 /* return true if we have seen data segments. */
-#define STREAM_HAS_SEEN_DATA(stream)    (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset)
+#define STREAM_HAS_SEEN_DATA(stream)    (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset || (stream)->sb.buf_offset)
 
 typedef struct TcpStream_ {
     uint16_t flags:12;              /**< Flag specific to the stream e.g. Timestamp */