From: Victor Julien <vjulien@oisf.net>
Date: Thu, 8 Sep 2022 11:57:45 +0000 (+0200)
Subject: output/frame: improve 'complete' logging
X-Git-Tag: suricata-7.0.0-rc1~111
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d72bc364de4a9c63f78ce5344319b9de97115745;p=thirdparty%2Fsuricata.git

output/frame: improve 'complete' logging
---

diff --git a/src/output-json-frame.c b/src/output-json-frame.c
index 72d68dbcdb..2b594a3f07 100644
--- a/src/output-json-frame.c
+++ b/src/output-json-frame.c
@@ -158,8 +158,13 @@ static void FrameAddPayloadTCP(JsonBuilder *js, const TcpStream *stream, const F
     SCLogDebug("frame data_offset %" PRIu64 ", data_len %u frame len %" PRIi64, data_offset,
             sb_data_len, frame->len);
 
-    // TODO update to work with large frames
-    jb_set_bool(js, "complete", ((int64_t)sb_data_len >= frame->len));
+    bool complete = false;
+    if (frame->len > 0) {
+        const uint64_t frame_re = frame->offset + (uint64_t)frame->len;
+        const uint64_t data_re = data_offset + sb_data_len;
+        complete = frame_re <= data_re;
+    }
+    jb_set_bool(js, "complete", complete);
 
     uint32_t data_len = MIN(sb_data_len, 256);
     jb_set_base64(js, "payload", data, data_len);