From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 21 May 2025 13:34:26 +0000 (+0200)
Subject: detect/files: increment local_file_id even if buffer is NULL
X-Git-Tag: suricata-8.0.0-rc1~225
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F13292%2Fhead;p=thirdparty%2Fsuricata.git

detect/files: increment local_file_id even if buffer is NULL

Ticket: 7579

Otherwise, we will keep on calling again and again GetDataCallback
with the same local_file_id, and we will always get a NULL
buffer even if the next local_file_id would return a non-NULL buffer.
---

diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index 0bc6c31872..54a3ca0511 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -506,8 +506,10 @@ uint8_t DetectEngineInspectFiledata(DetectEngineCtx *de_ctx, DetectEngineThreadC
     for (; file != NULL; file = file->next) {
         InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, transforms, f, flags, file,
                 engine->sm_list, engine->sm_list_base, local_file_id, txv);
-        if (buffer == NULL)
+        if (buffer == NULL) {
+            local_file_id++;
             continue;
+        }
 
         bool eof = (file->state == FILE_STATE_CLOSED);
         uint8_t ciflags = eof ? DETECT_CI_FLAGS_END : 0;
@@ -555,8 +557,10 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pect
         for (File *file = ffc->head; file != NULL; file = file->next) {
             InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, ctx->transforms, f, flags,
                     file, list_id, ctx->base_list_id, local_file_id, txv);
-            if (buffer == NULL)
+            if (buffer == NULL) {
+                local_file_id++;
                 continue;
+            }
             SCLogDebug("[%" PRIu64 "] buffer size %u", p->pcap_cnt, buffer->inspect_len);
 
             if (buffer->inspect_len >= mpm_ctx->minlen) {
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 2a33be7570..1d756bb4d7 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -326,8 +326,10 @@ static uint8_t DetectEngineInspectFilemagic(DetectEngineCtx *de_ctx, DetectEngin
     for (File *file = ffc->head; file != NULL; file = file->next) {
         InspectionBuffer *buffer = FilemagicGetDataCallback(
                 det_ctx, transforms, f, flags, file, engine->sm_list, local_file_id);
-        if (buffer == NULL)
+        if (buffer == NULL) {
+            local_file_id++;
             continue;
+        }
 
         const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f,
                 buffer->inspect, buffer->inspect_len, buffer->inspect_offset,
diff --git a/src/detect-filename.c b/src/detect-filename.c
index 5a4321c198..df67166c32 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -263,8 +263,10 @@ static uint8_t DetectEngineInspectFilename(DetectEngineCtx *de_ctx, DetectEngine
     for (File *file = ffc->head; file != NULL; file = file->next) {
         InspectionBuffer *buffer = FilenameGetDataCallback(
                 det_ctx, transforms, f, flags, file, engine->sm_list, local_file_id);
-        if (buffer == NULL)
+        if (buffer == NULL) {
+            local_file_id++;
             continue;
+        }
 
         const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f,
                 buffer->inspect, buffer->inspect_len, buffer->inspect_offset,