From 78f5e082f5188204606ab9ceb5044447e49aaca2 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 13 Jan 2022 12:13:43 +0100 Subject: [PATCH] stream: fix stream pruning being too aggressive Pruning of StreamBufferBlocks could remove blocks that fell entirely after the target offset due to a logic error. This could lead to data being evicted that was still meant to be processed in theapp-layer parsers. Bug: #4953. --- src/util-streaming-buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/util-streaming-buffer.c b/src/util-streaming-buffer.c index 577bc3b635..3e6375c625 100644 --- a/src/util-streaming-buffer.c +++ b/src/util-streaming-buffer.c @@ -412,7 +412,7 @@ static void SBBPrune(StreamingBuffer *sb) StreamingBufferBlock *sbb = NULL, *safe = NULL; RB_FOREACH_SAFE(sbb, SBB, &sb->sbb_tree, safe) { /* completely beyond window, we're done */ - if (sbb->offset > sb->stream_offset) { + if (sbb->offset >= sb->stream_offset) { sb->head = sbb; break; } -- 2.47.2