base64_data: reject fast_pattern use

If a rule has fast_pattern on base64_data, it is anyway not applied, so,
consider any such rules invalid.

Bug 5220
pull/11072/head
Shivani Bhardwaj 3 years ago committed by Victor Julien
parent cb56752bf7
commit 363050616a

@ -272,6 +272,10 @@ static int DetectFastPatternSetup(DetectEngineCtx *de_ctx, Signature *s, const c
}
}
}
if (SigMatchListSMBelongsTo(s, pm) == DETECT_SM_LIST_BASE64_DATA) {
SCLogError("fast_pattern cannot be used with base64_data");
goto error;
}
cd->flags |= DETECT_CONTENT_FAST_PATTERN;
return 0;
}

Loading…
Cancel
Save