From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 4 Mar 2025 15:30:19 +0000 (+0100)
Subject: files: append data on closing even with FILE_NOSTORE
X-Git-Tag: suricata-7.0.9~21
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=da092a5d839b0cd2c51ff6df43dfa87d25fdd969;p=thirdparty%2Fsuricata.git

files: append data on closing even with FILE_NOSTORE

Ticket: 7577

When HTTP1 post multipart handles a small file, it will call
HTPFileClose with some data
This data needs to be appended to the streaming buffer for usage
by file.data keyword even if we do not end up storing the file

(cherry picked from commit f68e2f5537c95388858129aa1b076e976354584a)
---

diff --git a/src/util-file.c b/src/util-file.c
index 89ef50c1d4..47b169ce72 100644
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -1018,11 +1018,10 @@ int FileCloseFilePtr(File *ff, const StreamingBufferConfig *sbcfg, const uint8_t
                 SCLogDebug("file %p data %p data_len %u", ff, data, data_len);
                 SCSha256Update(ff->sha256_ctx, data, data_len);
             }
-        } else {
-            if (AppendData(sbcfg, ff, data, data_len) != 0) {
-                ff->state = FILE_STATE_ERROR;
-                SCReturnInt(-1);
-            }
+        }
+        if (AppendData(sbcfg, ff, data, data_len) != 0) {
+            ff->state = FILE_STATE_ERROR;
+            SCReturnInt(-1);
         }
     }