fix for bug 227. For negated contents that have been added to mpm we might have pmq.pattern_id_array_cnt as 0. We can't ignore inspecting sigs if this is 0, in case the content added is negated

remotes/origin/master-1.1.x
Anoop Saldanha 15 years ago committed by Victor Julien
parent 9ad1924dba
commit 0d741b9a55

@ -956,10 +956,10 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
uint8_t pmq_idx = 0;
StreamMsg *smsg_inspect = smsg;
for ( ; smsg_inspect != NULL; smsg_inspect = smsg_inspect->next, pmq_idx++) {
if (det_ctx->smsg_pmq[pmq_idx].pattern_id_array_cnt == 0) {
SCLogDebug("no match in smsg_inspect %p (%u), idx %d", smsg_inspect, smsg_inspect->data.data_len, pmq_idx);
continue;
}
//if (det_ctx->smsg_pmq[pmq_idx].pattern_id_array_cnt == 0) {
// SCLogDebug("no match in smsg_inspect %p (%u), idx %d", smsg_inspect, smsg_inspect->data.data_len, pmq_idx);
// continue;
//}
if (det_ctx->smsg_pmq[pmq_idx].pattern_id_bitarray != NULL) {
/* filter out sigs that want pattern matches, but

Loading…
Cancel
Save