diff --git a/src/detect-offset.c b/src/detect-offset.c index 8eb2e89f1e..cddc4509c3 100644 --- a/src/detect-offset.c +++ b/src/detect-offset.c @@ -59,9 +59,15 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) } ud->offset = (uint32_t)atoi(str); if (ud->depth != 0 && (ud->uricontent_len + ud->offset) > ud->depth) { - SCLogDebug("depth increased to %"PRIu32" to match pattern len" - " and offset", ud->uricontent_len + ud->offset); - ud->depth = ud->uricontent_len + ud->offset; + if (ud->depth > ud->uricontent_len) { + SCLogDebug("depth increased to %"PRIu32" to match pattern len" + " and offset", ud->depth + ud->offset); + ud->depth += ud->offset; + } else { + SCLogDebug("depth increased to %"PRIu32" to match pattern len" + " and offset", ud->uricontent_len + ud->offset); + ud->depth = ud->uricontent_len + ud->offset; + } } break; @@ -74,9 +80,15 @@ int DetectOffsetSetup (DetectEngineCtx *de_ctx, Signature *s, char *offsetstr) } cd->offset = (uint32_t)atoi(str); if (cd->depth != 0 && (cd->content_len + cd->offset) > cd->depth) { - SCLogDebug("depth increased to %"PRIu32" to match pattern len" - " and offset", cd->content_len + cd->offset); - cd->depth = cd->content_len + cd->offset; + if (cd->depth > cd->content_len) { + SCLogDebug("depth increased to %"PRIu32" to match pattern len" + " and offset", cd->depth + cd->offset); + cd->depth += cd->offset; + } else { + SCLogDebug("depth increased to %"PRIu32" to match pattern len" + " and offset", cd->content_len + cd->offset); + cd->depth = cd->content_len + cd->offset; + } } break;