From: Russ Combs <rucombs@cisco.com>
Date: Wed, 1 Jul 2015 17:40:00 +0000 (-0400)
Subject: Squashed commit of the following:
X-Git-Tag: 3.0.0-233~938
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d938847e554f7ad63e7d37f7363697d414ca04cb;p=thirdparty%2Fsnort3.git

Squashed commit of the following:

commit 2013351aa4e456f3bd910dcf08ba7289b6fa9b45
Author: Tom Peters <thopeter@cisco.com>
Date:   Tue Jun 30 14:57:43 2015 -0400

    File processing complete

commit be3c57506fe6e654da94e962150a7114ac99ec56
Author: Tom Peters <thopeter@cisco.com>
Date:   Fri Jun 26 13:55:35 2015 -0400

    File processing stage 2 - MIME but not unexpected close processing
---

diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
index 6894886b0..198831bb2 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.cc
@@ -52,6 +52,12 @@ NHttpFlowData::~NHttpFlowData()
         delete transaction[k];
         delete cutter[k];
     }
+
+    if (mime_state != nullptr)
+    {
+        free_mime_session(mime_state);
+    }
+
     delete_pipeline();
 }
 
@@ -60,21 +66,27 @@ void NHttpFlowData::half_reset(SourceId source_id)
     assert((source_id == SRC_CLIENT) || (source_id == SRC_SERVER));
 
     version_id[source_id] = VERS__NOTPRESENT;
+    data_length[source_id] = STAT_NOTPRESENT;
+    body_octets[source_id] = STAT_NOTPRESENT;
+    section_size_target[source_id] = 0;
+    section_size_max[source_id] = 0;
+    file_depth_remaining[source_id] = STAT_NOTPRESENT;
+    infractions[source_id].reset();
+    events[source_id].reset();
+
     if (source_id == SRC_CLIENT)
     {
         method_id = METH__NOTPRESENT;
+        if (mime_state != nullptr)
+        {
+            free_mime_session(mime_state);
+            mime_state = nullptr;
+        }
     }
     else
     {
         status_code_num = STAT_NOTPRESENT;
     }
-    data_length[source_id] = STAT_NOTPRESENT;
-    body_octets[source_id] = STAT_NOTPRESENT;
-    section_size_target[source_id] = 0;
-    section_size_max[source_id] = 0;
-    file_depth_remaining[source_id] = STAT_NOTPRESENT;
-    infractions[source_id].reset();
-    events[source_id].reset();
 }
 
 void NHttpFlowData::show(FILE* out_file) const
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h
index e220afbaf..fcc86a81a 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_flow_data.h
@@ -22,6 +22,7 @@
 
 #include <stdio.h>
 #include "stream/stream_api.h"
+#include "file_api/file_mime_process.h"
 
 #include "nhttp_cutter.h"
 #include "nhttp_infractions.h"
@@ -95,6 +96,7 @@ private:
     NHttpEnums::MethodId method_id = NHttpEnums::METH__NOTPRESENT;
     int32_t status_code_num = NHttpEnums::STAT_NOTPRESENT;
     int64_t file_depth_remaining[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT };
+    MimeState* mime_state = nullptr;  // SRC_CLIENT only
 
     // number of user data octets seen so far (regular body or chunks)
     int64_t body_octets[2] = { NHttpEnums::STAT_NOTPRESENT, NHttpEnums::STAT_NOTPRESENT };
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
index 2297f602b..2eae4015d 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_body.cc
@@ -23,6 +23,7 @@
 
 #include "detection/detection_util.h"
 #include "file_api/file_api.h"
+#include "file_api/file_mime_process.h"
 
 #include "nhttp_enum.h"
 #include "nhttp_msg_request.h"
@@ -44,7 +45,16 @@ void NHttpMsgBody::analyze()
     data.start = msg_text.start;
     data.length = msg_text.length;
 
-    do_file_processing();
+    // Always set file data. File processing will later set a new value in some cases.
+    if (data.length > 0)
+    {
+        set_file_data(const_cast<uint8_t*>(data.start), (unsigned)data.length);
+    }
+
+    if (session_data->file_depth_remaining[source_id] > 0)
+    {
+        do_file_processing();
+    }
 
     body_octets += msg_text.length;
 
@@ -54,25 +64,28 @@ void NHttpMsgBody::analyze()
 
 void NHttpMsgBody::do_file_processing()
 {
-    // Always set file data. File processing will later set a new value in some cases.
-    set_file_data((uint8_t*)data.start, (unsigned)data.length);
-
-    if (session_data->file_depth_remaining[source_id] > 0)
+    // Using the trick that cutter is deleted when regular or chunked body is complete
+    const bool front = (body_octets == 0);
+    const bool back = (session_data->cutter[source_id] == nullptr) || tcp_close;
+    FilePosition file_position;
+    if (front && back) file_position = SNORT_FILE_FULL;
+    else if (front) file_position = SNORT_FILE_START;
+    else if (back) file_position = SNORT_FILE_END;
+    else file_position = SNORT_FILE_MIDDLE;
+
+    // Chunked body with nothing but the zero length chunk?
+    if (front && (data.length == 0))
     {
-        // Using the trick that cutter is deleted when regular or chunked body is complete
-        const bool front = (body_octets == 0);
-        const bool back = (session_data->cutter[source_id] == nullptr) || tcp_close;
-        FilePosition file_position;
-        if (front && back) file_position = SNORT_FILE_FULL;
-        else if (front) file_position = SNORT_FILE_START;
-        else if (back) file_position = SNORT_FILE_END;
-        else file_position = SNORT_FILE_MIDDLE;
-
-        int32_t fp_length = (data.length <= session_data->file_depth_remaining[source_id]) ?
-            data.length : session_data->file_depth_remaining[source_id];
+        return;
+    }
+
+    const int32_t fp_length = (data.length <= session_data->file_depth_remaining[source_id]) ?
+        data.length : session_data->file_depth_remaining[source_id];
 
+    if (source_id == SRC_SERVER)
+    {
         if (file_api->file_process(flow, const_cast<uint8_t*>(data.start), fp_length,
-            file_position, source_id == SRC_CLIENT, false))
+            file_position, false, false))
         {
             session_data->file_depth_remaining[source_id] -= fp_length;
 
@@ -97,6 +110,18 @@ void NHttpMsgBody::do_file_processing()
             session_data->file_depth_remaining[source_id] = 0;
         }
     }
+    else
+    {
+        file_api->process_mime_data(flow, data.start, data.start + fp_length,
+            session_data->mime_state, true, file_position);
+
+        session_data->file_depth_remaining[source_id] -= fp_length;
+        if (session_data->file_depth_remaining[source_id] == 0)
+        {
+            free_mime_session(session_data->mime_state);
+            session_data->mime_state = nullptr;
+        }
+    }
 }
 
 void NHttpMsgBody::gen_events()
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
index b872d24c3..83b65e8d4 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_chunk.cc
@@ -21,6 +21,8 @@
 #include <sys/types.h>
 #include <stdio.h>
 
+#include "file_api/file_mime_process.h"
+
 #include "nhttp_enum.h"
 #include "nhttp_msg_chunk.h"
 
@@ -52,6 +54,12 @@ void NHttpMsgChunk::update_flow()
         session_data->type_expected[source_id] = SEC_TRAILER;
         session_data->infractions[source_id].reset();
         session_data->events[source_id].reset();
+
+        if ((source_id == SRC_CLIENT) && (session_data->mime_state != nullptr))
+        {
+            free_mime_session(session_data->mime_state);
+            session_data->mime_state = nullptr;
+        }
     }
     else
     {
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
index 9d1a5b435..d5d472167 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.cc
@@ -21,8 +21,8 @@
 #include <sys/types.h>
 #include <stdio.h>
 
+#include "utils/util.h"
 #include "detection/detection_util.h"
-#include "file_api/file_api.h"
 
 #include "nhttp_enum.h"
 #include "nhttp_msg_request.h"
@@ -104,6 +104,18 @@ void NHttpMsgHeader::update_flow()
         if (session_data->file_depth_remaining[1-source_id] <= 0)
         {   // Bidirectional file processing is problematic FIXIT-M
             session_data->file_depth_remaining[source_id] = file_api->get_max_file_depth();
+            if (source_id == SRC_CLIENT)
+            {
+                // FIXIT-L Cannot use new because file_api insists on freeing the mime_state using
+                // free().
+                session_data->mime_state = (MimeState*) new_calloc(1, sizeof(MimeState));
+                file_api->set_mime_log_config_defauts(&mime_conf);
+                session_data->mime_state->log_config = &mime_conf;
+                file_api->set_mime_decode_config_defauts(&decode_conf);
+                session_data->mime_state->decode_conf = &decode_conf;
+                file_api->set_log_buffers(&session_data->mime_state->log_state,
+                    session_data->mime_state->log_config);
+            }
         }
         session_data->infractions[source_id].reset();
         session_data->events[source_id].reset();
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
index 807e19082..0fe04b181 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
+++ b/src/service_inspectors/nhttp_inspect/nhttp_msg_header.h
@@ -20,6 +20,8 @@
 #ifndef NHTTP_MSG_HEADER_H
 #define NHTTP_MSG_HEADER_H
 
+#include "file_api/file_api.h"
+
 #include "nhttp_msg_head_shared.h"
 
 //-------------------------------------------------------------------------
@@ -34,6 +36,10 @@ public:
     void print_section(FILE* output) override;
     void gen_events() override;
     void update_flow() override;
+private:
+    // Dummy configurations to support MIME processing
+    MAIL_LogConfig mime_conf;
+    DecodeConfig decode_conf;
 };
 
 #endif
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
index 95f4a09eb..1af30bcf4 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
+++ b/src/service_inspectors/nhttp_inspect/nhttp_stream_splitter.cc
@@ -432,11 +432,12 @@ bool NHttpStreamSplitter::finish(Flow* flow)
     }
 
     session_data->tcp_close[source_id] = true;
+
     // If there is leftover data for which we returned PAF_SEARCH and never flushed, we need to set
     // up to process because it is about to go to reassemble(). But we don't support partial start
     // lines.
     if ((session_data->section_type[source_id] == SEC__NOTCOMPUTE) &&
-        (session_data->cutter[source_id] != nullptr) &&
+        (session_data->cutter[source_id] != nullptr)               &&
         (session_data->cutter[source_id]->get_octets_seen() > 0))
     {
         if ((session_data->type_expected[source_id] == SEC_REQUEST) ||
@@ -453,7 +454,29 @@ bool NHttpStreamSplitter::finish(Flow* flow)
             session_data->cutter[source_id]->get_num_head_lines() + 1,
             session_data->cutter[source_id]->get_is_broken_chunk(),
             session_data->cutter[source_id]->get_num_good_chunks());
+        return true;
+    }
+
+    // If there is no more data to process we need to wrap up file processing right now
+    if ((session_data->section_type[source_id] == SEC__NOTCOMPUTE) &&
+        (session_data->file_depth_remaining[source_id] > 0)        &&
+        (session_data->cutter[source_id] != nullptr)               &&
+        (session_data->cutter[source_id]->get_octets_seen() == 0))
+    {
+        if (source_id == SRC_SERVER)
+        {
+            file_api->file_process(flow, nullptr, 0, SNORT_FILE_END, false, false);
+        }
+        else
+        {
+            file_api->process_mime_data(flow, nullptr, 0, session_data->mime_state, true,
+                SNORT_FILE_END);
+            free_mime_session(session_data->mime_state);
+            session_data->mime_state = nullptr;
+        }
+        return false;
     }
+
     return true;
 }
 
diff --git a/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt b/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt
index 7ad93375d..5686242db 100644
--- a/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt
+++ b/src/service_inspectors/nhttp_inspect/nhttp_test_msgs.txt
@@ -861,6 +861,221 @@ Accept-Language: en,  de\r\n
 Accept-Language: is\r\n
 \r\n
 
+@9003
+@break
+@response
+HTTP/1.1 200 Example with exactly 16384 octets\r\nTransfer-Encoding: chunked\r\n\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+400\r\n
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+1234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890
+123456789012345678901234\r\n
+
+0\r\n\r\n
+
 # ***********************************************************************************************
 # Invalid chunks
 # @10001
diff --git a/src/utils/util.h b/src/utils/util.h
index 19920da61..066672ad2 100644
--- a/src/utils/util.h
+++ b/src/utils/util.h
@@ -137,6 +137,16 @@ static inline void* SnortAlloc(unsigned long size)
     return NULL;
 }
 
+static inline void* new_calloc(size_t num, size_t size)
+{
+    void* ret_val = calloc(num, size);
+    if (ret_val == nullptr)
+    {
+        throw std::bad_alloc();
+    }
+    return ret_val;
+}
+
 static inline long SnortStrtol(const char* nptr, char** endptr, int base)
 {
     long iRet;