Suricata

Btw this works to prevent the crash, but I'm not sure it's the proper fix.

diff --git a/src/util-spm.c b/src/util-spm.c
index 04e7676..5c9bc05 100644
--- a/src/util-spm.c
+++ b/src/util-spm.c
@@ -113,8 +113,11 @@ SpmGlobalThreadCtx *SpmInitGlobalThreadCtx(uint16_t matcher)

 void SpmDestroyGlobalThreadCtx(SpmGlobalThreadCtx *global_thread_ctx)
 {
+    if (global_thread_ctx != NULL) {
     uint16_t matcher = global_thread_ctx->matcher;
+    if (spm_table[matcher].DestroyGlobalThreadCtx!= NULL)
     spm_table[matcher].DestroyGlobalThreadCtx(global_thread_ctx);
+    }
 }

 SpmThreadCtx *SpmMakeThreadCtx(const SpmGlobalThreadCtx *global_thread_ctx)

Ah it's not actually a full rule reload. It's start up with delayed detect enabled. This starts with an empty (minimal) detection engine, then forces a reload. So perhaps the issue is that the 'minimal' detect engine is freed too aggressively.

So, it looks like init of the SPM table needs to happen earlier (or more often). I'll take a look at this today.

Actually, ignore my last comment, spm_table is fine.

Victor: as you thought, this is the minimal detection engine, which gets a NULL pointer for its SpmGlobalThreadCtx. I think that allowing the Destroy functions in the SPM API to accept NULL pointers is a reasonable fix.

I've written and tested a patch -- will file a PR in a moment.