From 28ac75b50594f464949c036bbb34ceff759bdc9c Mon Sep 17 00:00:00 2001 From: Juliana Fajardini Date: Mon, 9 May 2022 11:24:18 -0300 Subject: [PATCH] detect/alert: directly increment alerts.discarded In the unlikely case of AlertQueueExpand failure, we were incrementing the discarded alerts stats in AlertQueueAppend via the Packet member in the DetectEngineThreadCtx, which may not be initialized yet. Bug #5353 --- src/detect-engine-alert.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c index 98fe24c2dc..359c224de9 100644 --- a/src/detect-engine-alert.c +++ b/src/detect-engine-alert.c @@ -268,7 +268,7 @@ void AlertQueueAppend(DetectEngineThreadCtx *det_ctx, const Signature *s, Packet /* we must grow the alert queue */ if (pos == AlertQueueExpand(det_ctx)) { /* this means we failed to expand the queue */ - det_ctx->p->alerts.discarded++; + p->alerts.discarded++; return; } } -- 2.47.2