From b8e7d3a2593ee5673aabac267ac0f2a5ea4fbe93 Mon Sep 17 00:00:00 2001
From: Eric Leblond <eric@regit.org>
Date: Mon, 19 Jan 2015 19:16:49 +0100
Subject: [PATCH] flow-timeout: fix init of pseudo packet

The code was not checking if we had enough room in the direct
data. In case default_packet_size was set really small, this was
resulting in data being written over the data and causing a crash.

The patch fixes the issue by forcing an allocation if the direct
data size in the Packet is to small.
---
 src/flow-timeout.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/flow-timeout.c b/src/flow-timeout.c
index a3de51da64..afd1ef71cd 100644
--- a/src/flow-timeout.c
+++ b/src/flow-timeout.c
@@ -108,6 +108,14 @@ static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p,
             p->dp = f->sp;
         }
 
+        /* Check if we have enough room in direct data. We need ipv4 hdr + tcp hdr.
+         * Force an allocation if it is not the case.
+         */
+        if (GET_PKT_DIRECT_MAX_SIZE(p) <  40) {
+            if (PacketCallocExtPkt(p, 40) == -1) {
+                return NULL;
+            }
+        }
         /* set the ip header */
         p->ip4h = (IPV4Hdr *)GET_PKT_DATA(p);
         /* version 4 and length 20 bytes for the tcp header */
@@ -145,6 +153,14 @@ static inline Packet *FlowForceReassemblyPseudoPacketSetup(Packet *p,
             p->dp = f->sp;
         }
 
+        /* Check if we have enough room in direct data. We need ipv6 hdr + tcp hdr.
+         * Force an allocation if it is not the case.
+         */
+        if (GET_PKT_DIRECT_MAX_SIZE(p) <  60) {
+            if (PacketCallocExtPkt(p, 60) == -1) {
+                return NULL;
+            }
+        }
         /* set the ip header */
         p->ip6h = (IPV6Hdr *)GET_PKT_DATA(p);
         /* version 6 */