From c7909e14cbcf9a7103b44df5e225eb7c5c7ce704 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 29 Jul 2026 13:24:00 +0200 Subject: [PATCH 1/2] ftp/expectation: fix ippair leak Ticket: 5204 ippair use_cnt increased by AppLayerExpectationCreate calling IPPairGetIPPairFromHash was never decreased (cherry picked from commit 425b9c67774e2f630a84fbff3cbafc7512b8e705) --- src/app-layer-expectation.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/app-layer-expectation.c b/src/app-layer-expectation.c index 6635054268a6..87c1037ef734 100644 --- a/src/app-layer-expectation.c +++ b/src/app-layer-expectation.c @@ -188,6 +188,7 @@ static ExpectationList *AppLayerExpectationRemove(IPPair *ipp, { CIRCLEQ_REMOVE(&exp_list->list, exp, entries); AppLayerFreeExpectation(exp); + IPPairDecrUsecnt(ipp); SC_ATOMIC_SUB(expectation_count, 1); exp_list->length--; if (exp_list->length == 0) { From 2c8594f39b1607ed009ef704e53e5e36cb6f5a55 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 22 Jul 2026 13:36:35 +0200 Subject: [PATCH 2/2] http2: find content-encoding without case-sensitivity See RFC 9110 8.4.1 > All content codings are case-insensitive Ticket: 8760 (cherry picked from commit 46880985ef0a5cc92d64c098aac07364a48ee2e9) --- rust/src/http2/decompression.rs | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/rust/src/http2/decompression.rs b/rust/src/http2/decompression.rs index a7bebf70239b..7d4af774c268 100644 --- a/rust/src/http2/decompression.rs +++ b/rust/src/http2/decompression.rs @@ -190,15 +190,15 @@ impl HTTP2DecoderHalf { pub fn http2_encoding_fromvec(&mut self, input: &[u8]) { //use first encoding... if self.encoding == HTTP2ContentEncoding::Unknown { - if input == b"gzip" { + if input.eq_ignore_ascii_case(b"gzip") { self.encoding = HTTP2ContentEncoding::Gzip; self.decoder = HTTP2Decompresser::Gzip(Box::new(GzDecoder::new(HTTP2cursor::new()))); - } else if input == b"deflate" { + } else if input.eq_ignore_ascii_case(b"deflate") { self.encoding = HTTP2ContentEncoding::Deflate; self.decoder = HTTP2Decompresser::Deflate(Box::new(DeflateDecoder::new(HTTP2cursor::new()))); - } else if input == b"br" { + } else if input.eq_ignore_ascii_case(b"br") { self.encoding = HTTP2ContentEncoding::Br; self.decoder = HTTP2Decompresser::Brotli(Box::new(brotli::Decompressor::new( HTTP2cursor::new(),