Suricata

In util-hash.c I have observed some behavior that is unexpected and likely incorrect. To see this behavior, create a hash table 32 entries wide and use the default hash function. Then add a short string “abc”, observe the string is stored properly. Now remove a string “iln”, and observe string “abc” is no longer in the table.

Other scenarios can provoke this behavior but this is possibly the simplest way. It occurs because if the table slot has one entry, remove does not perform a compare before removal.

I have a unit test patch to show this, and a fix patch to make it behave as a typical hash table would behave. The behavior goes back to at least 6.0 and continues into the current 8.0.1 work branch.

I am working on a PR now.