files: always initialize inspect_window and min_inspect_depth

This is to make sure the files buffers are properly managed even
when there are no rules or when there are no file.data rules.

Bug: #5703.
(cherry picked from commit e601ebdfd8)
pull/8212/head
Victor Julien 3 years ago
parent acec24a816
commit 5db0ef4415

@ -139,10 +139,6 @@ void DetectFiledataRegister(void)
g_file_data_buffer_id = DetectBufferTypeGetByName("file_data");
}
#define FILEDATA_CONTENT_LIMIT 100000
#define FILEDATA_CONTENT_INSPECT_MIN_SIZE 32768
#define FILEDATA_CONTENT_INSPECT_WINDOW 4096
static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) {
if (de_ctx->filedata_config_initialized)
return;

@ -913,6 +913,9 @@ static File *FileOpenFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg
FileContainerAdd(ffc, ff);
/* set default window and min inspection size */
FileSetInspectSizes(ff, FILEDATA_CONTENT_INSPECT_WINDOW, FILEDATA_CONTENT_INSPECT_MIN_SIZE);
ff->size += data_len;
if (data != NULL) {
if (AppendData(ff, data, data_len) != 0) {

@ -49,6 +49,10 @@
#define FILE_USE_DETECT BIT_U16(13) /**< use content_inspected tracker */
#define FILE_HAS_GAPS BIT_U16(15)
#define FILEDATA_CONTENT_LIMIT 100000
#define FILEDATA_CONTENT_INSPECT_MIN_SIZE 32768
#define FILEDATA_CONTENT_INSPECT_WINDOW 4096
typedef enum FileState_ {
FILE_STATE_NONE = 0, /**< no state */
FILE_STATE_OPENED, /**< flow file is opened */

Loading…
Cancel
Save