From 82fa3bc1248f03cae75c0de43ce17567b1813a06 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Wed, 4 Jul 2018 15:10:34 +0200
Subject: [PATCH] detect: fix memory leak in app-layer-event keyword

Bug #2515.
---
 src/detect-app-layer-event.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index 02e58560a1..ed4f7fdc8d 100644
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -310,6 +310,9 @@ static int DetectAppLayerEventSetupP2(Signature *s,
     if (DetectAppLayerEventParseAppP2((DetectAppLayerEventData *)sm->ctx, s->proto.proto,
                                       &event_type) < 0) {
         /* DetectAppLayerEventParseAppP2 prints errors */
+
+        /* sm has been removed from lists by DetectAppLayerEventPrepare */
+        SigMatchFree(sm);
         return -1;
     }
     SigMatchAppendSMToList(s, sm, g_applayer_events_list_id);
-- 
2.47.2