From 29c98799e8eda99496ba3a74ef306b53c02f7406 Mon Sep 17 00:00:00 2001
From: Victor Julien <vjulien@oisf.net>
Date: Fri, 7 Aug 2026 08:09:18 +0000
Subject: [PATCH] stream: tcp: fix AddAndRotate NULL deref with max-syn-queued
 1

AddAndRotate() assumes the SYN queue has at least two elements when
evicting the oldest to make room for a new one. With stream.max-syn-queued
set to 1 this would not be true leading to crash.

Ticket: #8833.
---
 src/stream-tcp.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/stream-tcp.c b/src/stream-tcp.c
index 620e39c2d4..696dea618f 100644
--- a/src/stream-tcp.c
+++ b/src/stream-tcp.c
@@ -1943,11 +1943,16 @@ static const TcpStateQueue *StreamTcp3whsFindSyn(
 static void AddAndRotate(TcpSession *ssn, TcpStateQueue *tail, TcpStateQueue *search)
 {
     TcpStateQueue *old_head = ssn->queue;
-    TcpStateQueue *new_head = old_head->next;
-    /* set new head */
-    ssn->queue = new_head;
 
-    /* old head node is now appended to the list tail */
+    if (tail == old_head) {
+        /* single-element list: overwrite in place */
+        *old_head = *search;
+        old_head->next = NULL;
+        return;
+    }
+
+    /* multi-element list: pop head, append after tail, reuse as new tail */
+    ssn->queue = old_head->next;
     tail->next = old_head;
 
     *old_head = *search;
@@ -1964,7 +1969,7 @@ static int StreamTcp3whsStoreSyn(TcpSession *ssn, Packet *p)
     if (ssn->queue != NULL && StreamTcp3whsFindSyn(ssn, &search, &tail, false) != NULL)
         return 0;
 
-    if (ssn->queue_len > 0 && ssn->queue_len == stream_config.max_syn_queued) {
+    if (ssn->queue != NULL && ssn->queue_len == stream_config.max_syn_queued) {
         DEBUG_VALIDATE_BUG_ON(ssn->queue == NULL);
         SCLogDebug("%" PRIu64 ": ssn %p: =~ SYN queue limit reached, rotate", PcapPacketCntGet(p),
                 ssn);