diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst index ae89d27bdb..1175743c28 100644 --- a/doc/userguide/configuration/suricata-yaml.rst +++ b/doc/userguide/configuration/suricata-yaml.rst @@ -2037,6 +2037,10 @@ An app-layer event `protocol.too_many_transactions` is triggered when this value The point of this parameter is to find a balance between the completeness of analysis and the resource consumption. +When this threshold is reached, a new transaction will not be allocated, +and the flow will be put in error state, as it would become too expensive +in terms of CPU for Suricata to continue processing it. + For HTTP2, this parameter is named `max-streams` as an HTTP2 stream will get translated into one Suricata transaction. This configuration parameter is used whatever the value of `SETTINGS_MAX_CONCURRENT_STREAMS` negotiated between a client and a server diff --git a/src/app-layer-ftp.c b/src/app-layer-ftp.c index f33ecfd55f..c9af1b8a4a 100644 --- a/src/app-layer-ftp.c +++ b/src/app-layer-ftp.c @@ -234,6 +234,7 @@ static FTPTransaction *FTPTransactionCreate(FtpState *state) break; } } + return NULL; } FTPTransaction *tx = FTPCalloc(1, sizeof(*tx)); if (tx == NULL) {