detect/mpm: fix fast_pattern handling of len >255

The fast pattern selection logic would truncate a patterns len to
255 leading to assigning the same pid to different patterns.

This in turn would be caught by the hyperscan setup code which would
abort.

Bug #2714.
pull/3563/head
Victor Julien 7 years ago
parent eedf08be29
commit 6f2b974f9c

@ -1505,7 +1505,7 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
return -1;
uint8_t *content = NULL;
uint8_t content_len = 0;
uint16_t content_len = 0;
PatIntId max_id = 0;
DetectFPAndItsId *struct_offset = (DetectFPAndItsId *)ahb;
uint8_t *content_offset = ahb + struct_total_size;

Loading…
Cancel
Save