From 6162d986a24a57ebbd9cd208c0a69750933e6346 Mon Sep 17 00:00:00 2001 From: Seth Hall Date: Wed, 8 Apr 2015 13:41:03 -0400 Subject: [PATCH] Fix an issue with files having gaps before the bof_buffer is filled. When files had gaps prior to the bof_buffer completely filling, the file gap handling code was never sniffing and passing along as much data as possible so file type identification wasn't working correctly. --- src/file_analysis/File.cc | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/file_analysis/File.cc b/src/file_analysis/File.cc index d0b1ea2a01..2b0d76f8d6 100644 --- a/src/file_analysis/File.cc +++ b/src/file_analysis/File.cc @@ -538,7 +538,12 @@ void File::Gap(uint64 offset, uint64 len) return; } - analyzers.DrainModifications(); + if ( ! bof_buffer.full ) + { + DBG_LOG(DBG_FILE_ANALYSIS, "[%s] File gap before bof_buffer filled, continued without attempting to fill bof_buffer.", id.c_str()); + bof_buffer.full = true; + DeliverStream((const u_char*) "", 0); + } file_analysis::Analyzer* a = 0; IterCookie* c = analyzers.InitForIteration();