From 8b56c543485123511e43d7bb384e1866b70d0b7d Mon Sep 17 00:00:00 2001
From: Seth Hall <seth@icir.org>
Date: Fri, 21 Oct 2011 14:03:31 -0400
Subject: [PATCH] Slightly restructured http file hashing to fix a bug.

---
 scripts/base/protocols/http/file-hash.bro | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/scripts/base/protocols/http/file-hash.bro b/scripts/base/protocols/http/file-hash.bro
index 6da624728d..094a905eeb 100644
--- a/scripts/base/protocols/http/file-hash.bro
+++ b/scripts/base/protocols/http/file-hash.bro
@@ -54,14 +54,11 @@ event http_entity_data(c: connection, is_orig: bool, length: count, data: string
 ## incorrect anyway.
 event content_gap(c: connection, is_orig: bool, seq: count, length: count) &priority=5
 	{
-	if ( is_orig || ! c?$http ) return;
-		
+	if ( is_orig || ! c?$http || ! c$http$calculating_md5 ) return;
+	
 	set_state(c, F, is_orig);
-	if ( c$http$calculating_md5 )
-		{
-		c$http$calculating_md5 = F;
-		md5_hash_finish(c$id);
-		}
+	c$http$calculating_md5 = F;
+	md5_hash_finish(c$id);
 	}
 
 ## When the file finishes downloading, finish the hash and generate a notice.