From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Mon, 3 Nov 2014 18:11:21 +0000 (-0500)
Subject: prevent repeated small chunk length alerts from hi
X-Git-Tag: 3.0.0-233~1273
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=8ca049a2b4b58fa05883d2f161ec673b6aeb1bba;p=thirdparty%2Fsnort3.git

prevent repeated small chunk length alerts from hi
---

diff --git a/ChangeLog b/ChangeLog
index 8c035c1de..4954e4e56 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -19,6 +19,8 @@
 -- changed doc to use "legacy" instead of "classic"
 -- restricted reload to basic modules and inspectors only
 -- commented out snort.process() and snort.reload_hosts() for alpha 1
+-- codec fix from Josh
+-- prevent repeated small chunk length alerts from HI
 
 126
 -- pulled latest from tom
diff --git a/src/service_inspectors/http_inspect/hi_client.cc b/src/service_inspectors/http_inspect/hi_client.cc
index dc86b688c..9cf7b83fb 100644
--- a/src/service_inspectors/http_inspect/hi_client.cc
+++ b/src/service_inspectors/http_inspect/hi_client.cc
@@ -139,6 +139,7 @@ int CheckChunkEncoding(HI_SESSION *session, const u_char *start, const u_char *e
     uint32_t iDataLen = 0;
     uint32_t chunkBytesCopied = 0;
     uint8_t stateless_chunk_count = 0;
+    bool alerted = false;
 
     if(!start || !end)
         return HI_INVALID_ARG;
@@ -224,7 +225,11 @@ int CheckChunkEncoding(HI_SESSION *session, const u_char *start, const u_char *e
                         (*chunk_count)++;
                         if ( *chunk_count >= session->server_conf->small_chunk_length.num )
                         {
-                            SnortEventqAdd(gid, sid);
+                            if ( !alerted )
+                            {
+                                SnortEventqAdd(gid, sid);
+                                alerted = true;
+                            }
                             *chunk_count = 0;
                         }
                     }