From ba7db2583b0d96627d3088dd3d89b69ad21ff757 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Thu, 23 Mar 2023 15:42:18 +0100 Subject: [PATCH] detect/urilen: fix applying urilen as depth If urilen induced depth was set, later DetectContentPropagateLimits() would apply a wrong depth setting, leading to a false negative in some cases. Bug: #5929. --- src/detect-urilen.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/detect-urilen.c b/src/detect-urilen.c index 4a719da790..6f7c4da206 100644 --- a/src/detect-urilen.c +++ b/src/detect-urilen.c @@ -202,6 +202,7 @@ void DetectUrilenApplyToContent(Signature *s, int list) if (cd->depth == 0 || cd->depth > high) { cd->depth = high; + cd->flags |= DETECT_CONTENT_DEPTH; SCLogDebug("updated %u, content %u to have depth %u " "because of urilen.", s->id, cd->id, cd->depth); }