Project

General

Profile

Actions

Bug #5788

open

files: output modifies file state

Added by Victor Julien about 1 year ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

In case of files that aren't properly closed the output-file and output-filedata logic will update the file state and even call FileCloseFile (filedata). This is not correct as the files should have been closed earlier in the pipeline, so that Detect has the files available in their final state.

I suspect that what is needed is that we need to truncate-close the files on the final invocation of the parsers with the APP_LAYER_PARSER_EOF_T* flags.

No data to display

Actions

Also available in: Atom PDF