Suricata

In case of files that aren't properly closed the output-file and output-filedata logic will update the file state and even call FileCloseFile (filedata). This is not correct as the files should have been closed earlier in the pipeline, so that Detect has the files available in their final state.

I suspect that what is needed is that we need to truncate-close the files on the final invocation of the parsers with the APP_LAYER_PARSER_EOF_T* flags.