From dab679889cf3a915edc382e97f0a6c13fa277eca Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Tue, 25 May 2010 21:52:26 +0200
Subject: [PATCH] Properly update depth if offset+content_len < depth. Fixes
 #164.

---
 src/detect-depth.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/detect-depth.c b/src/detect-depth.c
index 31a8d16a49..954fcec867 100644
--- a/src/detect-depth.c
+++ b/src/detect-depth.c
@@ -72,6 +72,7 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
 
     DetectUricontentData *ud = NULL;
     DetectContentData *cd = NULL;
+
     switch (pm->type) {
         case DETECT_URICONTENT:
             ud = (DetectUricontentData *)pm->ctx;
@@ -82,9 +83,12 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
             }
             ud->depth = (uint32_t)atoi(str);
             if (ud->uricontent_len + ud->offset > ud->depth) {
+                uint32_t depth = (ud->depth > ud->uricontent_len) ?
+                    ud->depth : ud->uricontent_len;
+                cd->depth = cd->offset + depth;
+
                 SCLogDebug("depth increased to %"PRIu32" to match pattern len "
-                        "and offset", ud->uricontent_len + ud->offset);
-                ud->depth = ud->uricontent_len + ud->offset;
+                        "and offset", ud->depth);
             }
         break;
 
@@ -97,9 +101,12 @@ static int DetectDepthSetup (DetectEngineCtx *de_ctx, Signature *s, char *depths
             }
             cd->depth = (uint32_t)atoi(str);
             if (cd->content_len + cd->offset > cd->depth) {
+                uint32_t depth = (cd->depth > cd->content_len) ?
+                    cd->depth : cd->content_len;
+                cd->depth = cd->offset + depth;
+
                 SCLogDebug("depth increased to %"PRIu32" to match pattern len "
-                        "and offset", cd->content_len + cd->offset);
-                cd->depth = cd->content_len + cd->offset;
+                        "and offset", cd->depth);
             }
         break;