From 8c747380aeae01c1fcedd99f6400078b1ff6a2b0 Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Thu, 8 Oct 2009 16:42:10 +0200
Subject: [PATCH] Fixup ip_proto keyword.

---
 src/detect-engine-proto.c | 1 +
 src/detect-ipproto.c      | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/src/detect-engine-proto.c b/src/detect-engine-proto.c
index 79811a0cd0..18f1754280 100644
--- a/src/detect-engine-proto.c
+++ b/src/detect-engine-proto.c
@@ -73,6 +73,7 @@ int DetectProtoParse(DetectProto *dp, char *str) {
     } else if (strcasecmp(str,"ip") == 0) {
         /* Proto "ip" is treated as an "any" */
         dp->flags |= DETECT_PROTO_ANY;
+        memset(dp->proto, 0xff, sizeof(dp->proto));
     } else {
         uint8_t proto_u8; /* Used to avoid sign extension */
 
diff --git a/src/detect-ipproto.c b/src/detect-ipproto.c
index 8edecd1ae5..2e00c8f16f 100644
--- a/src/detect-ipproto.c
+++ b/src/detect-ipproto.c
@@ -166,7 +166,10 @@ int DetectIPProtoSetup(DetectEngineCtx *de_ctx, Signature *s,
     data = DetectIPProtoParse((const char *)optstr);
     if (data == NULL) goto error;
 
+    /* reset our "any" (or "ip") state */
     s->proto.flags &= ~DETECT_PROTO_ANY;
+    memset(s->proto.proto, 0x00, sizeof(s->proto.proto));
+
     switch (data->op) {
         case DETECT_IPPROTO_OP_EQ:
             s->proto.proto[data->proto/8] |= 1 << (data->proto%8);