Fix a FP with negated filemagic inspection.

13 years ago · adb5d05fb5
parent 0b9038b971
commit adb5d05fb5
1 changed files with 1 additions and 3 deletions
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@ -174,9 +174,7 @@ int DetectFilemagicMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f
            if (!(filemagic->flags & DETECT_CONTENT_NEGATED)) {
                ret = 1;
            }
-        }
-
-        if (ret == 0 && filemagic->flags & DETECT_CONTENT_NEGATED) {
+        } else if (filemagic->flags & DETECT_CONTENT_NEGATED) {
            SCLogDebug("negated match");
            ret = 1;
        }