From 66c500eaac41bd471efe9d0171ec09a0be98417a Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Wed, 3 Jul 2019 16:39:19 +0200
Subject: [PATCH] leak: Fixes leak in DetectAppLayerEventPrepare

---
 src/detect-app-layer-event.c | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/detect-app-layer-event.c b/src/detect-app-layer-event.c
index 9452ee4340..5459049af5 100644
--- a/src/detect-app-layer-event.c
+++ b/src/detect-app-layer-event.c
@@ -349,14 +349,28 @@ static void DetectAppLayerEventFree(void *ptr)
 int DetectAppLayerEventPrepare(Signature *s)
 {
     SigMatch *sm = s->init_data->smlists[g_applayer_events_list_id];
+    SigMatch *smn;
     s->init_data->smlists[g_applayer_events_list_id] = NULL;
     s->init_data->smlists_tail[g_applayer_events_list_id] = NULL;
 
     while (sm != NULL) {
+        // save it for later use in loop
+        smn = sm->next;
+        /* these will be overwritten in SigMatchAppendSMToList
+         * called by DetectAppLayerEventSetupP2
+         */
         sm->next = sm->prev = NULL;
-        if (DetectAppLayerEventSetupP2(s, sm) < 0)
+        if (DetectAppLayerEventSetupP2(s, sm) < 0) {
+            // current one was freed, let's free the next ones
+            sm = smn;
+            while(sm) {
+                smn = sm->next;
+                SigMatchFree(sm);
+                sm = smn;
+            }
             return -1;
-        sm = sm->next;
+        }
+        sm = smn;
     }
 
     return 0;