SCLogDebug("Invalid negated content. \"!\" located twice at the "
"start of the contet string: %s",contentstr);
gotoerror;
}else{
temp=str;
if((str=strdup(temp+1))==NULL)
gotoerror;
cd->negated=1;
free(temp);
temp=NULL;
}
}
/*This was submitted as a patch for bug #11. But this impliments incorrect behavior as !
*insideofquotesshouldbetreatedasnormalmatch.*/
//if (str[0] == '!') {
// if (cd->negated == 1) {
// SCLogDebug("Invalid negated content. \"!\" located twice at the "
// "start of the contet string: %s", contentstr);
// goto error;
// } else {
// temp = str;
// if ( (str = strdup(temp + 1)) == NULL)
// goto error;
// cd->negated = 1;
// free(temp);
// temp = NULL;
// }
//}
len=strlen(str);
if(len==0)
@ -2659,7 +2661,7 @@ int DetectContentParseNegTest12(void) {
intDetectContentParseNegTest13(void){
intresult=0;
DetectContentData*cd=NULL;
char*teststring="\"!boo\"";
char*teststring="!\"boo\"";
cd=DetectContentParse(teststring);
if(cd!=NULL){
@ -2676,7 +2678,7 @@ int DetectContentParseNegTest14(void) {
cd=DetectContentParse(teststring);
if(cd!=NULL){
result=(cd->negated==1);
result=(cd->negated==0);
DetectContentFree(cd);
}
returnresult;
@ -3056,7 +3058,7 @@ static int SigTest74TestNegatedContent(void)
staticintSigTest75TestNegatedContent(void)
{
returnSigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:\"!PASS\"; sid:1;)",(uint8_t*)"USER apple");
returnSigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:\"!PASS\"; sid:1;)",(uint8_t*)"USER !PASS");