From: Philippe Antoine <contact@catenacyber.fr>
Date: Mon, 28 Feb 2022 10:21:28 +0000 (+0100)
Subject: range: better closing for out of order ranges
X-Git-Tag: suricata-7.0.0-beta1~841
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=3fd8e908f83602ce4c025f9f14536b90bd91f599;p=thirdparty%2Fsuricata.git

range: better closing for out of order ranges

Ticket: 5132

In case of a duplicate range, we can return early, because
there is no new data to process.

More importantly, this commit adds a check about wether the file
got closed meanwhile, so that this just completed out of order
range, even if it brings new data, is now irrelevant.
This can happen for instance if there was a gap...
---

diff --git a/src/app-layer-htp-range.c b/src/app-layer-htp-range.c
index ed7d6b1540..9e837f3604 100644
--- a/src/app-layer-htp-range.c
+++ b/src/app-layer-htp-range.c
@@ -493,6 +493,8 @@ File *HttpRangeClose(HttpRangeContainerBlock *c, uint16_t flags)
                 (void)SC_ATOMIC_SUB(ContainerUrlRangeList.ht->memuse, c->current->buflen);
                 SCFree(c->current->buffer);
                 SCFree(c->current);
+                c->current = NULL;
+                return NULL;
             }
             SCLogDebug("inserted range fragment");
             c->current = NULL;
@@ -500,6 +502,10 @@ File *HttpRangeClose(HttpRangeContainerBlock *c, uint16_t flags)
                 // we have to wait for the flow owning the file
                 return NULL;
             }
+            if (c->container->files->tail == NULL) {
+                // file has already been closed meanwhile
+                return NULL;
+            }
             // keep on going, maybe this out of order chunk
             // became the missing part between open and close
         }