detect: fix issue with smsg and seq wraps

Due to a broken sequence number check, detect could fail to process
smsgs in case of a sequence wrap. This could lead to excessive use
of smsg's but also of segments, since these aren't cleared until the
smsg containing them is.
pull/1652/head
Victor Julien 10 years ago
parent 8ac49d9129
commit e67188e437

@ -692,7 +692,7 @@ static StreamMsg *SigMatchSignaturesGetSmsg(Flow *f, Packet *p, uint8_t flags)
/* if the smsg is bigger than the current packet, we will
* process the smsg in a later run */
if ((head->seq + head->data_len) > (TCP_GET_SEQ(p) + p->payload_len)) {
if (SEQ_GT((head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len))) {
SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32,
(head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len));
goto end;
@ -711,7 +711,7 @@ static StreamMsg *SigMatchSignaturesGetSmsg(Flow *f, Packet *p, uint8_t flags)
/* if the smsg is bigger than the current packet, we will
* process the smsg in a later run */
if ((head->seq + head->data_len) > (TCP_GET_SEQ(p) + p->payload_len)) {
if (SEQ_GT((head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len))) {
SCLogDebug("smsg ends beyond current packet, skipping for now %"PRIu32">%"PRIu32,
(head->seq + head->data_len), (TCP_GET_SEQ(p) + p->payload_len));
goto end;

Loading…
Cancel
Save