From: Philippe Antoine <pantoine@oisf.net>
Date: Tue, 4 Mar 2025 15:30:19 +0000 (+0100)
Subject: files: append data on closing even with FILE_NOSTORE
X-Git-Tag: suricata-8.0.0-beta1~324
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f68e2f5537c95388858129aa1b076e976354584a;p=thirdparty%2Fsuricata.git

files: append data on closing even with FILE_NOSTORE

Ticket: 7577

When HTTP1 post multipart handles a small file, it will call
HTPFileClose with some data
This data needs to be appended to the streaming buffer for usage
by file.data keyword even if we do not end up storing the file
---

diff --git a/src/util-file.c b/src/util-file.c
index fdb8d740d8..e9faf3f04d 100644
--- a/src/util-file.c
+++ b/src/util-file.c
@@ -1019,11 +1019,10 @@ int FileCloseFilePtr(File *ff, const StreamingBufferConfig *sbcfg, const uint8_t
                 SCLogDebug("file %p data %p data_len %u", ff, data, data_len);
                 SCSha256Update(ff->sha256_ctx, data, data_len);
             }
-        } else {
-            if (AppendData(sbcfg, ff, data, data_len) != 0) {
-                ff->state = FILE_STATE_ERROR;
-                SCReturnInt(-1);
-            }
+        }
+        if (AppendData(sbcfg, ff, data, data_len) != 0) {
+            ff->state = FILE_STATE_ERROR;
+            SCReturnInt(-1);
         }
     }