mirror of https://github.com/OISF/suricata
ftp: point truncated lines at the unconsumed remainder
When a line exceeds the configured maximum length and contains no LF, FTPGetLineForDirection emitted a window starting at the beginning of the stream slice rather than at the unconsumed remainder. If a complete command had already been taken from the same slice, that window was shifted left by the consumed count: it began inside the previous command and stopped short of the end of the long one. The command MPM match, the per-transaction request copy and the port_line capture all ran over those stale bytes, so a long command hidden behind a short one in the same segment was classified and logged as the previous command. The response direction had the same problem. The LF-found branch already derives the line from input->buf + o_consumed; do the same here, and advance consumed so the cursor still describes the slice it was handed. Issue: 8859pull/16213/head
parent
172204be61
commit
2e8d50a9bd
Loading…
Reference in New Issue