diff --git a/CHANGES b/CHANGES index 3f64d91489..8ec7593749 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,9 @@ +2.4-20 | 2015-07-03 10:40:21 -0700 + + * Adding a weird for when truncated packets lead TCP reassembly to + ignore content. (Robin Sommer) + 2.4-19 | 2015-07-03 09:04:54 -0700 * A set of tests exercising IP defragmentation and TCP reassembly. diff --git a/VERSION b/VERSION index 040781c5ce..748c727101 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.4-19 +2.4-20 diff --git a/src/analyzer/protocol/tcp/TCP_Endpoint.cc b/src/analyzer/protocol/tcp/TCP_Endpoint.cc index 2e8d6e593b..846eb6d9d1 100644 --- a/src/analyzer/protocol/tcp/TCP_Endpoint.cc +++ b/src/analyzer/protocol/tcp/TCP_Endpoint.cc @@ -201,13 +201,18 @@ int TCP_Endpoint::DataSent(double t, uint64 seq, int len, int caplen, { int status = 0; - if ( contents_processor && caplen >= len ) - status = contents_processor->DataSent(t, seq, len, data); + if ( contents_processor ) + { + if ( caplen >= len ) + status = contents_processor->DataSent(t, seq, len, data); + else + TCP()->Weird("truncated_tcp_payload"); + } if ( caplen <= 0 ) return status; - if ( contents_file && ! contents_processor && + if ( contents_file && ! contents_processor && seq + len > contents_start_seq ) { int64 under_seq = contents_start_seq - seq;