Bug #7106
closedpacket: app-layer-events incorrectly used on recycled packets
Added by Juliana Fajardini Reichow almost 2 years ago. Updated almost 2 years ago.
OT Updated by OISF Ticketbot almost 2 years ago Actions #1
- Subtask #7107 added
OT Updated by OISF Ticketbot almost 2 years ago Actions #2
- Label deleted (
Needs backport to 7.0)
JL Updated by Jeff Lucovsky almost 2 years ago Actions #3
The app_layer_event packet field is allocated once and never freed. There are existing checks on whether the value is NULL. Thus, if a packet ever had this set, then the use of the same packet (via recycling), will also have it erroneously set.
When a packet is recycled, the app_layer_event memory should be freed and the pointer set to NULL.
JL Updated by Jeff Lucovsky almost 2 years ago Actions #4
- Status changed from New to In Review
PA Updated by Philippe Antoine almost 2 years ago Actions #5
- Related to Optimization #6728: detect: prefilter for events (decode, stream, app-layer, etc...) added
VJ Updated by Victor Julien almost 2 years ago Actions #6
I don't think the problem is that its not freed, as this is intentional. The problem is that some code assumes that it is freed.
PA Updated by Philippe Antoine almost 2 years ago Actions #7
- Related to Bug #6291: Performance degradation on Suricata devices with a small number of rules added
JL Updated by Jeff Lucovsky almost 2 years ago Actions #8
- Subject changed from packet: app-layer-events not freed upon packet reset to packet: app-layer-events incorrectly used on recycled packets
JL Updated by Jeff Lucovsky almost 2 years ago Actions #9
- Status changed from In Review to In Progress
- Assignee changed from Jeff Lucovsky to Philippe Antoine
PA Updated by Philippe Antoine almost 2 years ago Actions #10
- Status changed from In Progress to In Review
JF Updated by Juliana Fajardini Reichow almost 2 years ago Actions #11
Victor Julien wrote in #note-6:
I don't think the problem is that its not freed, as this is intentional. The problem is that some code assumes that it is freed.
oh. I had understood this differently. My bad.
PA Updated by Philippe Antoine almost 2 years ago Actions #12
- Status changed from In Review to Resolved
VJ Updated by Victor Julien almost 2 years ago Actions #13
- Status changed from Resolved to Closed