From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Fri, 5 Dec 2014 22:53:32 +0000 (-0500)
Subject: fixed frag alert squelching to restrict to fragged ip sessions only
X-Git-Tag: 3.0.0-233~1100^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5312475e31619f0444546d282c8af4d7fcdd8e38;p=thirdparty%2Fsnort3.git

fixed frag alert squelching to restrict to fragged ip sessions only
---

diff --git a/src/stream/ip/ip_session.cc b/src/stream/ip/ip_session.cc
index ef96d1746..d651d91c1 100644
--- a/src/stream/ip/ip_session.cc
+++ b/src/stream/ip/ip_session.cc
@@ -187,7 +187,7 @@ bool IpSession::add_alert(Packet*, uint32_t gid, uint32_t sid)
     FragTracker* ft = &tracker;
 
     /* Only track a certain number of alerts per session */
-    if ( ft->alert_count >= MAX_FRAG_ALERTS )
+    if ( !ft->engine || ft->alert_count >= MAX_FRAG_ALERTS )
         return false;
 
     ft->alert_gid[ft->alert_count] = gid;
@@ -201,6 +201,9 @@ bool IpSession::check_alerted(Packet* p, uint32_t gid, uint32_t sid)
 {
     FragTracker* ft = &tracker;
 
+    if ( !ft->engine )
+        return false;
+
     for ( unsigned i = 0; i < ft->alert_count; i++ )
     {
         /*  If this is a rebuilt packet and we've seen this alert before, return