From fecaa08f591c508b6486e7e9a2ee05636d1f9503 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 9 Mar 2026 11:56:55 +0100 Subject: [PATCH] stream/reassembly: improve progress tracking for GAP cases When during raw reassembly it is detected that last ack is moved beyond the progress and also beyond the data retrieved, update progress to the last ack value. Bug: #8272. (cherry picked from commit ac1a514c7b57ea24f603020ef790c59b84143244) --- src/stream-tcp-reassemble.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/stream-tcp-reassemble.c b/src/stream-tcp-reassemble.c index 25f0ce4feb..f6a6462619 100644 --- a/src/stream-tcp-reassemble.c +++ b/src/stream-tcp-reassemble.c @@ -1872,6 +1872,12 @@ static int StreamReassembleRawDo(const TcpSession *ssn, const TcpStream *stream, progress = mydata_offset; SCLogDebug("raw progress now %"PRIu64, progress); + /* data is beyond the progress we'd like, and also beyond the last ack: + * there is a gap and we can't expect it to get filled anymore. */ + } else if (mydata_offset > progress && mydata_offset == re) { + SCLogDebug("mydata_offset %" PRIu64 ", progress %" PRIu64 ", re %" PRIu64, + mydata_offset, progress, re); + progress = re; } else { SCLogDebug("not increasing progress, data gap => mydata_offset " "%"PRIu64" != progress %"PRIu64, mydata_offset, progress);