fixed the depth updation when content_len is small (bug 139)

src/detect-offset.c

@@ -59,9 +59,15 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
             }
             ud->offset = (uint32_t)atoi(str);
             if (ud->depth != 0 && (ud->uricontent_len + ud->offset) > ud->depth) {
-                SCLogDebug("depth increased to %"PRIu32" to match pattern len"
-                        " and offset", ud->uricontent_len + ud->offset);
-                ud->depth = ud->uricontent_len + ud->offset;
+                if (ud->depth > ud->uricontent_len) {
+                    SCLogDebug("depth increased to %"PRIu32" to match pattern len"
+                        " and offset", ud->depth + ud->offset);
+                    ud->depth += ud->offset;
+                } else {
+                    SCLogDebug("depth increased to %"PRIu32" to match pattern len"
+                            " and offset", ud->uricontent_len + ud->offset);
+                    ud->depth = ud->uricontent_len + ud->offset;
+                }
             }
             break;
 
@@ -74,9 +80,15 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr)
             }
             cd->offset = (uint32_t)atoi(str);
             if (cd->depth != 0 && (cd->content_len + cd->offset) > cd->depth) {
-                SCLogDebug("depth increased to %"PRIu32" to match pattern len"
-                        " and offset", cd->content_len + cd->offset);
-                cd->depth = cd->content_len + cd->offset;
+                if (cd->depth > cd->content_len) {
+                    SCLogDebug("depth increased to %"PRIu32" to match pattern len"
+                        " and offset", cd->depth + cd->offset);
+                    cd->depth += cd->offset;
+                } else {
+                    SCLogDebug("depth increased to %"PRIu32" to match pattern len"
+                            " and offset", cd->content_len + cd->offset);
+                    cd->depth = cd->content_len + cd->offset;
+                }
             }
             break;