diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc index 744a0aac76..0009db0e55 100644 --- a/src/analyzer/protocol/http/HTTP.cc +++ b/src/analyzer/protocol/http/HTTP.cc @@ -243,10 +243,13 @@ int HTTP_Entity::Undelivered(int64_t len) return 0; if ( is_partial_content ) + { precomputed_file_id = file_mgr->Gap(body_length, len, http_message->MyHTTP_Analyzer()->GetAnalyzerTag(), http_message->MyHTTP_Analyzer()->Conn(), http_message->IsOrig(), precomputed_file_id); + offset += len; + } else precomputed_file_id = file_mgr->Gap(body_length, len, http_message->MyHTTP_Analyzer()->GetAnalyzerTag(), diff --git a/testing/btest/Baseline/scripts.base.protocols.http.content-range-gap/extract_files.thefile b/testing/btest/Baseline/scripts.base.protocols.http.content-range-gap/extract_files.thefile new file mode 100644 index 0000000000..fc6cc2271f Binary files /dev/null and b/testing/btest/Baseline/scripts.base.protocols.http.content-range-gap/extract_files.thefile differ diff --git a/testing/btest/Traces/http/content-range-gap.trace b/testing/btest/Traces/http/content-range-gap.trace new file mode 100644 index 0000000000..e926cee09d Binary files /dev/null and b/testing/btest/Traces/http/content-range-gap.trace differ diff --git a/testing/btest/scripts/base/protocols/http/content-range-gap.bro b/testing/btest/scripts/base/protocols/http/content-range-gap.bro new file mode 100644 index 0000000000..a62e8aa362 --- /dev/null +++ b/testing/btest/scripts/base/protocols/http/content-range-gap.bro @@ -0,0 +1,8 @@ +# @TEST-EXEC: bro -r $TRACES/http/content-range-gap.trace %INPUT +# @TEST-EXEC: btest-diff extract_files/thefile + +event file_new(f: fa_file) + { + Files::add_analyzer(f, Files::ANALYZER_EXTRACT, + [$extract_filename="thefile"]); + }