|
|
@ -131,7 +131,7 @@ int DetectBytetestDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
if (flags & DETECT_BYTETEST_RELATIVE) {
|
|
|
|
if (flags & DETECT_BYTETEST_RELATIVE) {
|
|
|
|
SCLogDebug("relative, working with det_ctx->buffer_offset %"PRIu32", "
|
|
|
|
SCLogDebug("relative, working with det_ctx->buffer_offset %"PRIu32", "
|
|
|
|
"data->offset %"PRIu32"", det_ctx->buffer_offset, data->offset);
|
|
|
|
"data->offset %"PRIi32"", det_ctx->buffer_offset, data->offset);
|
|
|
|
|
|
|
|
|
|
|
|
ptr = payload + det_ctx->buffer_offset;
|
|
|
|
ptr = payload + det_ctx->buffer_offset;
|
|
|
|
len = payload_len - det_ctx->buffer_offset;
|
|
|
|
len = payload_len - det_ctx->buffer_offset;
|
|
|
@ -147,7 +147,7 @@ int DetectBytetestDoMatch(DetectEngineThreadCtx *det_ctx, Signature *s, SigMatch
|
|
|
|
//PrintRawDataFp(stdout,ptr,len);
|
|
|
|
//PrintRawDataFp(stdout,ptr,len);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
else {
|
|
|
|
else {
|
|
|
|
SCLogDebug("absolute, data->offset %"PRIu32"", data->offset);
|
|
|
|
SCLogDebug("absolute, data->offset %"PRIi32"", data->offset);
|
|
|
|
|
|
|
|
|
|
|
|
ptr = payload + offset;
|
|
|
|
ptr = payload + offset;
|
|
|
|
len = payload_len - offset;
|
|
|
|
len = payload_len - offset;
|
|
|
|