From 9676273e6d5e62971eade039f08b39b35768d163 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Wed, 5 May 2010 12:13:03 +0200
Subject: [PATCH] Kick out streams with gaps in them in the app layer parser
 until we add proper support.

---
 src/app-layer-parser.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/app-layer-parser.c b/src/app-layer-parser.c
index acfe957463..1a196178c7 100644
--- a/src/app-layer-parser.c
+++ b/src/app-layer-parser.c
@@ -707,6 +707,11 @@ int AppLayerParse(Flow *f, uint8_t proto, uint8_t flags, uint8_t *input,
     uint16_t parser_idx = 0;
     AppLayerProto *p = &al_proto_table[proto];
 
+    if (flags & STREAM_GAP) {
+        SCLogDebug("stream gap detected (missing packets), this is not yet supported.");
+        goto error;
+    }
+
     TcpSession *ssn = f->protoctx;
     if (ssn == NULL) {
         SCLogDebug("no TCP session");