Suricata

The app_layer_event packet field is allocated once and never freed. There are existing checks on whether the value is NULL. Thus, if a packet ever had this set, then the use of the same packet (via recycling), will also have it erroneously set.

When a packet is recycled, the app_layer_event memory should be freed and the pointer set to NULL.

I don't think the problem is that its not freed, as this is intentional. The problem is that some code assumes that it is freed.

Victor Julien wrote in #note-6:

I don't think the problem is that its not freed, as this is intentional. The problem is that some code assumes that it is freed.

oh. I had understood this differently. My bad.