From b4095bf683a7fcbcedc7ef015ed9e44cff17a9ed Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 21 May 2025 15:34:26 +0200 Subject: [PATCH] detect/files: increment local_file_id even if buffer is NULL Ticket: 7579 Otherwise, we will keep on calling again and again GetDataCallback with the same local_file_id, and we will always get a NULL buffer even if the next local_file_id would return a non-NULL buffer. --- src/detect-file-data.c | 8 ++++++-- src/detect-filemagic.c | 4 +++- src/detect-filename.c | 4 +++- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/src/detect-file-data.c b/src/detect-file-data.c index 0bc6c31872..54a3ca0511 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -506,8 +506,10 @@ uint8_t DetectEngineInspectFiledata(DetectEngineCtx *de_ctx, DetectEngineThreadC for (; file != NULL; file = file->next) { InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, transforms, f, flags, file, engine->sm_list, engine->sm_list_base, local_file_id, txv); - if (buffer == NULL) + if (buffer == NULL) { + local_file_id++; continue; + } bool eof = (file->state == FILE_STATE_CLOSED); uint8_t ciflags = eof ? DETECT_CI_FLAGS_END : 0; @@ -555,8 +557,10 @@ static void PrefilterTxFiledata(DetectEngineThreadCtx *det_ctx, const void *pect for (File *file = ffc->head; file != NULL; file = file->next) { InspectionBuffer *buffer = FiledataGetDataCallback(det_ctx, ctx->transforms, f, flags, file, list_id, ctx->base_list_id, local_file_id, txv); - if (buffer == NULL) + if (buffer == NULL) { + local_file_id++; continue; + } SCLogDebug("[%" PRIu64 "] buffer size %u", p->pcap_cnt, buffer->inspect_len); if (buffer->inspect_len >= mpm_ctx->minlen) { diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c index 2a33be7570..1d756bb4d7 100644 --- a/src/detect-filemagic.c +++ b/src/detect-filemagic.c @@ -326,8 +326,10 @@ static uint8_t DetectEngineInspectFilemagic(DetectEngineCtx *de_ctx, DetectEngin for (File *file = ffc->head; file != NULL; file = file->next) { InspectionBuffer *buffer = FilemagicGetDataCallback( det_ctx, transforms, f, flags, file, engine->sm_list, local_file_id); - if (buffer == NULL) + if (buffer == NULL) { + local_file_id++; continue; + } const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, buffer->inspect, buffer->inspect_len, buffer->inspect_offset, diff --git a/src/detect-filename.c b/src/detect-filename.c index 5a4321c198..df67166c32 100644 --- a/src/detect-filename.c +++ b/src/detect-filename.c @@ -263,8 +263,10 @@ static uint8_t DetectEngineInspectFilename(DetectEngineCtx *de_ctx, DetectEngine for (File *file = ffc->head; file != NULL; file = file->next) { InspectionBuffer *buffer = FilenameGetDataCallback( det_ctx, transforms, f, flags, file, engine->sm_list, local_file_id); - if (buffer == NULL) + if (buffer == NULL) { + local_file_id++; continue; + } const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, buffer->inspect, buffer->inspect_len, buffer->inspect_offset, -- 2.47.2