detect: use only one non-prefilter frame for prefilter

Ticket: 8590
(cherry picked from commit d62acf5d75)
pull/15813/head
Philippe Antoine 5 months ago committed by Victor Julien
parent ae85a0488e
commit 5449ae170b

@ -1022,6 +1022,12 @@ static int SetupNonPrefilter(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
tx_non_pf = true;
}
}
if (frame_non_pf) {
// we found a frame, do not look for other buffers
// which may include the same frame + transform
// but we only want 1 per signature
break;
}
}
/* handle hook only rules */
if (!tx_non_pf && s->init_data->hook.type == SIGNATURE_HOOK_TYPE_APP) {

Loading…
Cancel
Save