From de5b8ae0b45636352e641cff7eeb4f1fc89c8129 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 8 Dec 2023 10:31:21 +0100 Subject: [PATCH] detect/analyzer: print int keyword values correctly To avoid negative values to be misrepresented. Bug: #6615. --- src/detect-engine-analyzer.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index 0eda31b2fc..b936ba1e0c 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -703,10 +703,10 @@ static void DumpContent(JsonBuilder *js, const DetectContentData *cd) jb_set_uint(js, "depth", cd->depth); } if (cd->flags & DETECT_CONTENT_DISTANCE) { - jb_set_uint(js, "distance", cd->distance); + jb_set_int(js, "distance", cd->distance); } if (cd->flags & DETECT_CONTENT_WITHIN) { - jb_set_uint(js, "within", cd->within); + jb_set_int(js, "within", cd->within); } jb_set_bool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN); jb_set_bool(js, "relative_next", cd->flags & DETECT_CONTENT_RELATIVE_NEXT); @@ -779,9 +779,9 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData * jb_open_object(js, "byte_jump"); jb_set_uint(js, "nbytes", cd->nbytes); - jb_set_uint(js, "offset", cd->offset); + jb_set_int(js, "offset", cd->offset); jb_set_uint(js, "multiplier", cd->multiplier); - jb_set_uint(js, "post_offset", cd->post_offset); + jb_set_int(js, "post_offset", cd->post_offset); switch (cd->base) { case DETECT_BYTEJUMP_BASE_UNSET: jb_set_string(js, "base", "unset"); @@ -824,7 +824,7 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData * jb_open_object(js, "byte_test"); jb_set_uint(js, "nbytes", cd->nbytes); - jb_set_uint(js, "offset", cd->offset); + jb_set_int(js, "offset", cd->offset); switch (cd->base) { case DETECT_BYTETEST_BASE_UNSET: jb_set_string(js, "base", "unset");