From 41dfa01e5fe98831a8a40c0bc17b95e5f8a2c09e Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 15 Oct 2026 21:28:11 +0200
Subject: [PATCH] http1: only disable decompression after too many bombs

Ticket: 9200

And to do so, reinit the content_encoding, so that
we do not try to take a decompressor

(cherry picked from commit 37cc3548093870b244c1c85eb2c2e067d9ee27aa)
---
 rust/htp/src/request.rs  | 3 +++
 rust/htp/src/response.rs | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/rust/htp/src/request.rs b/rust/htp/src/request.rs
index f952f602d8..469ac7b446 100644
--- a/rust/htp/src/request.rs
+++ b/rust/htp/src/request.rs
@@ -1249,6 +1249,9 @@ impl ConnectionParser {
         let compression_options = self.cfg.compression_options;
         if self.bombs >= compression_options.get_max_bombs() {
             // skip decompression for this flow if too many bombs were seen
+            self.request_mut()
+                .unwrap()
+                .request_content_encoding_processing = HtpContentEncoding::None;
             return Ok(());
         }
         if encoding != HtpContentEncoding::None {
diff --git a/rust/htp/src/response.rs b/rust/htp/src/response.rs
index 9288a847b3..5c0b34db7e 100644
--- a/rust/htp/src/response.rs
+++ b/rust/htp/src/response.rs
@@ -1333,6 +1333,9 @@ impl ConnectionParser {
         let compression_options = self.cfg.compression_options;
         if self.bombs >= compression_options.get_max_bombs() {
             // skip decompression for this flow if too many bombs were seen
+            self.response_mut()
+                .unwrap()
+                .response_content_encoding_processing = HtpContentEncoding::None;
             return Ok(());
         }
         if encoding != HtpContentEncoding::None {