files: always initialize inspect_window and min_inspect_depth

This is to make sure the files buffers are properly managed even
when there are no rules or when there are no file.data rules.

Bug: #5703.
pull/8209/head
Victor Julien 2 years ago
parent cade6046c5
commit e601ebdfd8

@ -163,10 +163,6 @@ void DetectFiledataRegister(void)
g_file_data_buffer_id = DetectBufferTypeGetByName("file_data");
}
#define FILEDATA_CONTENT_LIMIT 100000
#define FILEDATA_CONTENT_INSPECT_MIN_SIZE 32768
#define FILEDATA_CONTENT_INSPECT_WINDOW 4096
static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) {
if (de_ctx->filedata_config_initialized)
return;

@ -955,6 +955,9 @@ static File *FileOpenFile(FileContainer *ffc, const StreamingBufferConfig *sbcfg
FileContainerAdd(ffc, ff);
/* set default window and min inspection size */
FileSetInspectSizes(ff, FILEDATA_CONTENT_INSPECT_WINDOW, FILEDATA_CONTENT_INSPECT_MIN_SIZE);
ff->size += data_len;
if (data != NULL) {
if (AppendData(ff, data, data_len) != 0) {

@ -61,6 +61,10 @@ typedef struct SCMd5 SCMd5;
// to be used instead of PATH_MAX which depends on the OS
#define SC_FILENAME_MAX 4096
#define FILEDATA_CONTENT_LIMIT 100000
#define FILEDATA_CONTENT_INSPECT_MIN_SIZE 32768
#define FILEDATA_CONTENT_INSPECT_WINDOW 4096
typedef enum FileState_ {
FILE_STATE_NONE = 0, /**< no state */
FILE_STATE_OPENED, /**< flow file is opened */

Loading…
Cancel
Save