From: Victor Julien <victor@inliniac.net>
Date: Mon, 14 Dec 2015 17:34:38 +0000 (+0100)
Subject: smtp: consider file state in file_data inspection limits
X-Git-Tag: suricata-3.0.1RC1~19
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=32bf68aef83aa3df393877860c249dde2b9f37fc;p=thirdparty%2Fsuricata.git

smtp: consider file state in file_data inspection limits
---

diff --git a/src/detect-engine-filedata-smtp.c b/src/detect-engine-filedata-smtp.c
index 829832f9dc..2af1fe0dd2 100644
--- a/src/detect-engine-filedata-smtp.c
+++ b/src/detect-engine-filedata-smtp.c
@@ -137,7 +137,7 @@ static uint8_t *DetectEngineSMTPGetBufferForTX(uint64_t tx_id,
     if ((smtp_config.content_limit == 0 ||
          curr_file->content_len_so_far < smtp_config.content_limit) &&
         curr_file->content_len_so_far < smtp_config.content_inspect_min_size &&
-        !(flags & STREAM_EOF)) {
+        !(flags & STREAM_EOF) && !(curr_file->state > FILE_STATE_OPENED)) {
         SCLogDebug("we still haven't seen the entire content. "
                    "Let's defer content inspection till we see the "
                    "entire content.");