From ffc847db01fbf81df8a647d7a794d99894e4939d Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 13 Feb 2018 13:42:39 +0100 Subject: [PATCH] file: fix files not getting pruned When the filedata logger is enabled (file extraction), but a file is not stored due to no rules matching to force this, the file would never be freed. This was caused by a check in the file pruning logic that only freed a file when the FILE_STORED flag was set. However files can also have the FILE_NOSTORE flag set which indicates that a file won't be stored. This patch makes sure that both conditions lead to file pruning. --- src/util-file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util-file.c b/src/util-file.c index 5b4a575ad6..2620758f6b 100644 --- a/src/util-file.c +++ b/src/util-file.c @@ -334,7 +334,7 @@ static int FilePruneFile(File *file) /* file is done when state is closed+, logging/storing is done (if any) */ if (file->state >= FILE_STATE_CLOSED && (!RunModeOutputFileEnabled() || (file->flags & FILE_LOGGED)) && - (!RunModeOutputFiledataEnabled() || (file->flags & FILE_STORED))) + (!RunModeOutputFiledataEnabled() || (file->flags & (FILE_STORED|FILE_NOSTORE)))) { SCReturnInt(1); } else { -- 2.47.2