From 316a411b6b40365ffff382967bec8bc22f18c192 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Wed, 27 Mar 2019 22:56:15 +0100
Subject: [PATCH] ssl : SSLProbingParser overflow fix

Found by fuzzing
Fixes ssl detection evasion by packet splitting
---
 src/app-layer-ssl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c
index d73658b64d..96411cd268 100644
--- a/src/app-layer-ssl.c
+++ b/src/app-layer-ssl.c
@@ -2628,7 +2628,7 @@ static AppProto SSLProbingParser(Flow *f, uint8_t direction,
         uint8_t *input, uint32_t ilen, uint8_t *rdir)
 {
     /* probably a rst/fin sending an eof */
-    if (ilen == 0)
+    if (ilen < 3)
         return ALPROTO_UNKNOWN;
 
     /* for now just the 3 byte header ones */