detect: properly store a stateful match if it happens at the start of inspection

13 years ago · 1598425a40
parent c3f4f8d46a
commit 1598425a40
1 changed files with 1 additions and 0 deletions
--- a/src/detect-engine-state.c
+++ b/src/detect-engine-state.c
@ -657,6 +657,7 @@ int DeStateDetectStartDetection(ThreadVars *tv, DetectEngineCtx *de_ctx,
                    sm = NULL; /* set to NULL as we have a match */

                    if (inspect_flags == 0 || (inspect_flags == match_flags)) {
+                        match_flags |= DE_STATE_FLAG_FULL_MATCH;
                        r = 1;
                    }
                    break;