Counters are not initialized in all places.
counter_alerts_overflow and counter_alerts_suppressed are only initialized in DetectEngineThreadCtxInit in detect-engine.c, but not in DetectEngineThreadCtxInitForReload.
i.e. once suricata rules are reload, these 2 counters would become invalid and writes to incorrect structure in StatsAddUI64. In fact, if one turns on debugging, the BUG_ON should trigger in StatsAddUI64.
Updated by Victor Julien 18 days ago
- Status changed from In Review to Closed