unittests for bug 134&139 and some typo correction

src/detect-content.c

@@ -40,6 +40,7 @@
 #include "util-debug.h"
 #include "util-spm-bm.h"
 #include "threads.h"
+#include "util-unittest-helper.h"
 
 int DetectContentMatch (ThreadVars *, DetectEngineThreadCtx *, Packet *, Signature *, SigMatch *);
 static int DetectContentSetup (DetectEngineCtx *, Signature *, char *);
@@ -1541,6 +1542,55 @@ static int SigTest75TestNegatedContent(void)
     return SigTestPositiveTestContent("alert tcp any any -> any any (msg:\"HTTP URI cap\"; content:\"USER\"; content:\"!PASS\"; sid:1;)",  (uint8_t *)"USER !PASS");
 }
 
+static int SigTest76TestBug134(void)
+{
+    uint8_t *buf = (uint8_t *)"test detect ${IFS} in traffic";
+    uint16_t buflen = strlen((char *)buf);
+    Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_TCP);
+    int result = 0;
+
+    p->dp = 515;
+    p->flowflags |= FLOW_PKT_ESTABLISHED;
+    p->flowflags |= FLOW_PKT_TOSERVER;
+    char sig[] = "alert tcp any any -> any 515 "
+            "(msg:\"detect IFS\"; flow:to_server,established; content:\"${IFS}\";"
+            " depth:50; offset:0; sid:900091; rev:1;)";
+    if (UTHPacketMatchSigMpm(p, sig, MPM_B2G) == 0) {
+        result = 0;
+        goto end;
+    }
+
+    result = 1;
+end:
+    if (p != NULL)
+        UTHFreePacket(p);
+    return result;
+}
+
+static int SigTest77TestBug139(void)
+{
+    uint8_t buf[] = {
+        0x12, 0x23, 0x34, 0x35, 0x52, 0x52, 0x24, 0x42, 0x22, 0x24,
+        0x52, 0x24, 0x82, 0x00, 0x00, 0x00, 0x00, 0x00, 0x24, 0x34 };
+    uint16_t buflen = sizeof(buf);
+    Packet *p = UTHBuildPacket( buf, buflen, IPPROTO_UDP);
+    int result = 0;
+
+    p->dp = 53;
+    char sig[] = "alert udp any any -> any 53 (msg:\"dns testing\";"
+                    " content:\"|00 00|\"; depth:5; offset:13; sid:9436601;"
+                    " rev:1;)";
+    if (UTHPacketMatchSigMpm(p, sig, MPM_B2G) == 0) {
+        result = 0;
+        goto end;
+    }
+
+    result = 1;
+end:
+    if (p != NULL)
+        UTHFreePacket(p);
+    return result;
+}
 #endif /* UNITTESTS */
 
 /**
@@ -1617,5 +1667,8 @@ void DetectContentRegisterTests(void)
     UtRegisterTest("SigTest74TestNegatedContent", SigTest74TestNegatedContent, 1);
     UtRegisterTest("SigTest75TestNegatedContent", SigTest75TestNegatedContent, 1);
 
+    UtRegisterTest("SigTest76TestBug134", SigTest76TestBug134, 1);
+    UtRegisterTest("SigTest77TestBug139", SigTest77TestBug139, 1);
+
 #endif /* UNITTESTS */
 }

src/detect-parse.c

@@ -555,9 +555,9 @@ static int SigParseActionRejectValidate(const char *action) {
 
 /**
  * \brief Parses the action that has been used by the Signature and allots it
- *        to its Signatue instance.
+ *        to its Signature instance.
  *
- * \param s      Pointer to the Signatue instance to which the action belongs.
+ * \param s      Pointer to the Signature instance to which the action belongs.
  * \param action Pointer to the action string used by the Signature.
  *
  * \retval  0 On successfully parsing the action string and adding it to the

src/detect.c

@@ -787,7 +787,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
     /* so now let's iterate the alerts and remove the ones after a pass rule
      * matched (if any) */
 end:
-    SCLogDebug("(p->action & ation pass)) = %"PRIu8, (p->action & ACTION_PASS));
+    SCLogDebug("(p->action & action pass)) = %"PRIu8, (p->action & ACTION_PASS));
     for (i = 0; i < p->alerts.cnt; i++) {
         SCLogDebug("Sig->num: %"PRIu16, p->alerts.alerts[i].num);
         s = de_ctx->sig_array[p->alerts.alerts[i].num];