reject rules with duplicate content modifiers

reject rules that have multiple depths, offsets, distances, fast_patterns, nocases, or rawbytes for the same content.

src/detect-depth.c

@@ -142,6 +142,11 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
                 goto error;
             }
 
+            if (cd->flags & DETECT_CONTENT_DEPTH) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't use multiple depths for the same content.");
+                goto error;
+            }
+
             if (str[0] != '-' && isalpha(str[0])) {
                 SigMatch *bed_sm =
                     DetectByteExtractRetrieveSMVar(str, s,

src/detect-distance.c

@@ -216,6 +216,11 @@ static int DetectDistanceSetup (DetectEngineCtx *de_ctx, Signature *s,
                 goto error;
             }
 
+            if (cd->flags & DETECT_CONTENT_DISTANCE) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't use multiple distances with the same content. ");
+                goto error;
+            }
+
             if (str[0] != '-' && isalpha(str[0])) {
                 SigMatch *bed_sm =
                     DetectByteExtractRetrieveSMVar(str, s,

src/detect-fast-pattern.c

@@ -269,6 +269,10 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, char *a
     }
 
     if (arg == NULL|| strcmp(arg, "") == 0) {
+        if (cd->flags & DETECT_CONTENT_FAST_PATTERN) {
+            SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't use multiple fast_pattern options for the same content. ");
+            goto error;
+        }
         cd->flags |= DETECT_CONTENT_FAST_PATTERN;
         return 0;
     }

src/detect-nocase.c

@@ -103,6 +103,10 @@ static int DetectNocaseSetup (DetectEngineCtx *de_ctx, Signature *s, char *nulls
                 SCLogError(SC_ERR_INVALID_ARGUMENT, "invalid argument");
                 SCReturnInt(-1);
             }
+            if (cd->flags & DETECT_CONTENT_NOCASE) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't use multiple nocase modifiers with the same content; ignoring this option. ");
+                SCReturnInt(-1);
+            }
             cd->flags |= DETECT_CONTENT_NOCASE;
             /* Recreate the context with nocase chars */
             BoyerMooreCtxToNocase(cd->bm_ctx, cd->content, cd->content_len);

src/detect-offset.c

@@ -141,6 +141,11 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
                 goto error;
             }
 
+            if (cd->flags & DETECT_CONTENT_OFFSET) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't use multiple offsets for the same content. ");
+                goto error;
+            }
+
             if (str[0] != '-' && isalpha(str[0])) {
                 SigMatch *bed_sm =
                     DetectByteExtractRetrieveSMVar(str, s,

src/detect-rawbytes.c

@@ -75,6 +75,10 @@ static int DetectRawbytesSetup (DetectEngineCtx *de_ctx, Signature *s, char *nul
         case DETECT_CONTENT:
         {
             DetectContentData *cd = (DetectContentData *)pm->ctx;
+            if (cd->flags & DETECT_CONTENT_RAWBYTES) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "You can't use multiple rawbytes modifiers for the same content. ");
+                SCReturnInt(-1);
+            }
             cd->flags |= DETECT_CONTENT_RAWBYTES;
             break;
         }