Project

General

Profile

Actions

Bug #5018

closed

MQTT can return AppLayerResult::incomplete forever and buffer forever

Added by Philippe Antoine almost 3 years ago. Updated over 2 years ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Needs backport to 6.0

Description

Cf https://github.com/OISF/suricata/pull/6851#discussion_r791479237

if parse_connect returns Err::Incomplete (for example because, there is not enough bytes for the properties), we will keep buffering forever because we have the full message with its length already cf let rem = &fullrem[..len];


Related issues 1 (0 open1 closed)

Copied to Suricata - Bug #5059: MQTT can return AppLayerResult::incomplete forever and buffer foreverClosedJason IshActions
Actions

Also available in: Atom PDF