From adb5d05fb5b987541304a4b5c5f062449ecff1ba Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Fri, 10 Feb 2012 14:49:03 +0100
Subject: [PATCH] Fix a FP with negated filemagic inspection.

---
 src/detect-filemagic.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 47446951ff..e6f093dbf9 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -174,9 +174,7 @@ int DetectFilemagicMatch (ThreadVars *t, DetectEngineThreadCtx *det_ctx, Flow *f
             if (!(filemagic->flags & DETECT_CONTENT_NEGATED)) {
                 ret = 1;
             }
-        }
-
-        if (ret == 0 && filemagic->flags & DETECT_CONTENT_NEGATED) {
+        } else if (filemagic->flags & DETECT_CONTENT_NEGATED) {
             SCLogDebug("negated match");
             ret = 1;
         }