From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Sat, 15 Nov 2014 00:11:14 +0000 (-0500)
Subject: fixed 296-9 tcp segfault
X-Git-Tag: 3.0.0-233~1216^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8a310153711800cb9e1d7412e06628cd8dbdda7d;p=thirdparty%2Fsnort3.git

fixed 296-9 tcp segfault
---

diff --git a/ChangeLog b/ChangeLog
index 0e353f43e..c67362234 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -31,6 +31,7 @@
 -- refactored main init / reload code
 -- fixed cmake -ldl issue
 -- fixed normalization broke by the init/reload refactoring :(
+-- fixed 296-9 tcp segfault
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug
diff --git a/src/stream/tcp/tcp_session.cc b/src/stream/tcp/tcp_session.cc
index 3fd119a48..44dcaecbc 100644
--- a/src/stream/tcp/tcp_session.cc
+++ b/src/stream/tcp/tcp_session.cc
@@ -3659,7 +3659,7 @@ static int StreamQueue(StreamTracker *st, Packet *p, TcpDataBlock *tdb,
             // Don't want to count retransmits as overlaps or do anything
             // else with them.  Account for retransmits of multiple PDUs
             // in one segment.
-            while (IsRetransmit(right, rdata, rsize, rseq))
+            if (IsRetransmit(right, rdata, rsize, rseq))
             {
                 rdata += right->size;
                 rsize -= right->size;
@@ -3674,19 +3674,9 @@ static int StreamQueue(StreamTracker *st, Packet *p, TcpDataBlock *tdb,
                     // All data was retransmitted
                     RetransmitHandle(p, tcpssn);
                     addthis = 0;
-                    break;
-                }
-                else if ((right == NULL) || (rsize < right->size))
-                {
-                    // Need to add new node or some data left to check
-                    break;
                 }
-            }
-
-            if ((rsize == 0) || (right == NULL))
-                break;
-            else if (rsize < right->size)
                 continue;
+            }
 
             STREAM5_DEBUG_WRAP(DebugMessage(DEBUG_STREAM_STATE,
                         "Got full right overlap\n"););