From 640d03bef54bec939e5d6db05f317e0bd3805ad4 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 9 Mar 2026 11:56:55 +0100 Subject: [PATCH] stream/reassembly: improve progress tracking for GAP cases When during raw reassembly it is detected that last ack is moved beyond the progress and also beyond the data retrieved, update progress to the last ack value. Bug: #8272. (cherry picked from commit ac1a514c7b57ea24f603020ef790c59b84143244) --- src/stream-tcp-reassemble.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 387740c452..d28402c97e 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1879,6 +1879,12 @@ static int StreamReassembleRawDo(const TcpSession *ssn, const TcpStream *stream, progress = mydata_offset; SCLogDebug("raw progress now %"PRIu64, progress); + /* data is beyond the progress we'd like, and also beyond the last ack: + * there is a gap and we can't expect it to get filled anymore. */ + } else if (mydata_offset > progress && mydata_offset == re) { + SCLogDebug("mydata_offset %" PRIu64 ", progress %" PRIu64 ", re %" PRIu64, + mydata_offset, progress, re); + progress = re; } else { SCLogDebug("not increasing progress, data gap => mydata_offset " "%"PRIu64" != progress %"PRIu64, mydata_offset, progress);