doc/bytemath: document the result of wide shifts

Record that << and >> yield 0 when rvalue is 64 or more, beside the
existing note about division by zero. A shift count can come from a
byte_extract variable, so the rule text alone does not say which
counts land in that case.

Issue: 8845
pull/16141/head
Jeff Lucovsky 4 weeks ago committed by Victor Julien
parent 89d09c457c
commit 4a647784c7

@ -569,6 +569,8 @@ When ``relative`` is included, there must be a previous ``content`` or ``pcre``
Note: if ``oper`` is ``/`` and the divisor is 0, there will never be a match on the ``byte_math`` keyword.
Note: if ``oper`` is ``<<`` or ``>>`` and ``rvalue`` is 64 or greater, the result is 0.
The result can be stored in a result variable and referenced by
other rule options later in the rule.

Loading…
Cancel
Save