From 558945dc5ee6f585a5408759130d2302bc4ef5ac Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 6 Aug 2026 17:48:06 +0000 Subject: [PATCH] ftp/expectation: fix IPPair lock+refcount leak on alloc fail AppLayerExpectationCreate gets a locked and ref counted IPPair from IPPairGetIPPairFromHash. On the success path it correctly drops both with IPPairUnlock (keeping the ref for lifecycle). The else- branch that creates per-IPPair ExpectationLists calls SCCalloc. If that allocation fails, neither Unlock nor Release is called, leaving the IPPair mutex permanently held and its refcount elevated. Any subsequent worker thread that looks up the same IPPair blocks forever in SCCMutexLock. This patch addresses this by properly releasing the IPPair in the allocation error path. Ticket: #8851. --- src/app-layer-expectation.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/app-layer-expectation.c b/src/app-layer-expectation.c index d28e40c7dd..579582114a 100644 --- a/src/app-layer-expectation.c +++ b/src/app-layer-expectation.c @@ -257,8 +257,10 @@ int AppLayerExpectationCreate(Flow *f, int direction, Port src, Port dst, } } else { exp_list = SCCalloc(1, sizeof(*exp_list)); - if (exp_list == NULL) + if (exp_list == NULL) { + IPPairRelease(ipp); goto error; + } exp_list->length = 0; CIRCLEQ_INIT(&exp_list->list); CIRCLEQ_INSERT_HEAD(&exp_list->list, exp, entries);