From: Victor Julien <vjulien@oisf.net>
Date: Thu, 13 Jan 2022 11:13:43 +0000 (+0100)
Subject: stream: fix stream pruning being too aggressive
X-Git-Tag: suricata-5.0.9~103
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e6ac61029551d2257a658482c8f49bfff304b87f;p=thirdparty%2Fsuricata.git

stream: fix stream pruning being too aggressive

Pruning of StreamBufferBlocks could remove blocks that fell entirely
after the target offset due to a logic error. This could lead to data
being evicted that was still meant to be processed in theapp-layer
parsers.

Bug: #4953.
(cherry picked from commit 78f5e082f5188204606ab9ceb5044447e49aaca2)
---

diff --git a/src/util-streaming-buffer.c b/src/util-streaming-buffer.c
index fe140ec54f..4822e94af6 100644
--- a/src/util-streaming-buffer.c
+++ b/src/util-streaming-buffer.c
@@ -420,7 +420,7 @@ static void SBBPrune(StreamingBuffer *sb)
     StreamingBufferBlock *sbb = NULL, *safe = NULL;
     RB_FOREACH_SAFE(sbb, SBB, &sb->sbb_tree, safe) {
         /* completely beyond window, we're done */
-        if (sbb->offset > sb->stream_offset) {
+        if (sbb->offset >= sb->stream_offset) {
             sb->head = sbb;
             break;
         }