Allow non-existing flowints to be incremented. A 'set' to 0 is implied in this case.

src/detect-flowint.c

@@ -154,13 +154,13 @@ int DetectFlowintMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
     }
 
     if (fv != NULL && fv->datatype == FLOWVAR_TYPE_INT) {
-
         if (sfd->modifier == FLOWINT_MODIFIER_ADD) {
             SCLogDebug("Adding %u to %s", targetval, sfd->name);
             FlowVarAddInt(p->flow, sfd->idx, fv->data.fv_int.value +
                            targetval);
             return 1;
         }
+
         if (sfd->modifier == FLOWINT_MODIFIER_SUB) {
             SCLogDebug("Substracting %u to %s", targetval, sfd->name);
             FlowVarAddInt(p->flow, sfd->idx, fv->data.fv_int.value -
@@ -198,11 +198,20 @@ int DetectFlowintMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
                 exit(EXIT_FAILURE);
         }
     } else {
-        SCLogDebug("Var not found!");
-        /* It doesn't exist because it wasn't set
-        * or it is a string var, that we don't compare here
-        */
-        return 0;
+        /* allow a add on a non-existing var, it will init to the "add" value,
+         * so implying a 0 set. */
+        if (sfd->modifier == FLOWINT_MODIFIER_ADD) {
+            SCLogDebug("Adding %u to %s (new var)", targetval, sfd->name);
+            FlowVarAddInt(p->flow, sfd->idx, targetval);
+            return 1;
+        } else {
+
+            SCLogDebug("Var not found!");
+            /* It doesn't exist because it wasn't set
+             * or it is a string var, that we don't compare here
+             */
+            return 0;
+        }
     }
 }