From e500c59b994ef2c4ba1c2bd17b4d4ff674a144ef Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 24 Mar 2020 13:11:03 +0100 Subject: [PATCH] stream/tcp: fix STREAM_HAS_SEEN_DATA macro The macro would not return true for smaller TCP streams, leading to cases where the app-layer was not notified of EOF. --- src/stream-tcp-private.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/stream-tcp-private.h b/src/stream-tcp-private.h index 483d30d0e6..bd1f6d04ba 100644 --- a/src/stream-tcp-private.h +++ b/src/stream-tcp-private.h @@ -89,7 +89,7 @@ RB_PROTOTYPE(TCPSEG, TcpSegment, rb, TcpSegmentCompare); #define STREAM_SEQ_RIGHT_EDGE(stream) (stream)->segs_right_edge #define STREAM_RIGHT_EDGE(stream) (STREAM_BASE_OFFSET((stream)) + (STREAM_SEQ_RIGHT_EDGE((stream)) - (stream)->base_seq)) /* return true if we have seen data segments. */ -#define STREAM_HAS_SEEN_DATA(stream) (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset) +#define STREAM_HAS_SEEN_DATA(stream) (!RB_EMPTY(&(stream)->sb.sbb_tree) || (stream)->sb.stream_offset || (stream)->sb.buf_offset) typedef struct TcpStream_ { uint16_t flags:12; /**< Flag specific to the stream e.g. Timestamp */ -- 2.47.2