From: Victor Julien <vjulien@oisf.net>
Date: Thu, 13 Jan 2022 11:13:43 +0000 (+0100)
Subject: stream: fix stream pruning being too aggressive
X-Git-Tag: suricata-6.0.5~127
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=aae628b1bbad367bc84f362bc280e74f5843b783;p=thirdparty%2Fsuricata.git

stream: fix stream pruning being too aggressive

Pruning of StreamBufferBlocks could remove blocks that fell entirely
after the target offset due to a logic error. This could lead to data
being evicted that was still meant to be processed in theapp-layer
parsers.

Bug: #4953.
(cherry picked from commit 78f5e082f5188204606ab9ceb5044447e49aaca2)
---

diff --git a/src/util-streaming-buffer.c b/src/util-streaming-buffer.c
index 577bc3b635..3e6375c625 100644
--- a/src/util-streaming-buffer.c
+++ b/src/util-streaming-buffer.c
@@ -412,7 +412,7 @@ static void SBBPrune(StreamingBuffer *sb)
     StreamingBufferBlock *sbb = NULL, *safe = NULL;
     RB_FOREACH_SAFE(sbb, SBB, &sb->sbb_tree, safe) {
         /* completely beyond window, we're done */
-        if (sbb->offset > sb->stream_offset) {
+        if (sbb->offset >= sb->stream_offset) {
             sb->head = sbb;
             break;
         }