diff --git a/src/detect-dns-response.c b/src/detect-dns-response.c index 961a738e20..6483f1be48 100644 --- a/src/detect-dns-response.c +++ b/src/detect-dns-response.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2025 Open Information Security Foundation +/* Copyright (C) 2025-2026 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -174,7 +174,7 @@ static InspectionBuffer *GetBuffer(DetectEngineThreadCtx *det_ctx, uint8_t flags } InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len); - buffer->flags = DETECT_CI_FLAGS_SINGLE; + buffer->flags |= DETECT_CI_FLAGS_SINGLE; return buffer; } diff --git a/src/detect-engine.c b/src/detect-engine.c index f8ce5d9cf3..c066aa8477 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2022 Open Information Security Foundation +/* Copyright (C) 2007-2026 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -2373,7 +2373,7 @@ InspectionBuffer *DetectGetMultiData(struct DetectEngineThreadCtx_ *det_ctx, return NULL; } InspectionBufferSetupMulti(det_ctx, buffer, transforms, data, data_len); - buffer->flags = DETECT_CI_FLAGS_SINGLE; + buffer->flags |= DETECT_CI_FLAGS_SINGLE; return buffer; } diff --git a/src/detect-file-data.c b/src/detect-file-data.c index 293b826c73..43fbab0a27 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2022 Open Information Security Foundation +/* Copyright (C) 2007-2026 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -517,6 +517,7 @@ uint8_t DetectEngineInspectFiledata(DetectEngineCtx *de_ctx, DetectEngineThreadC uint8_t ciflags = file_done ? DETECT_CI_FLAGS_END : 0; if (buffer->inspect_offset == 0) ciflags |= DETECT_CI_FLAGS_START; + ciflags |= buffer->flags; const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, buffer->inspect, buffer->inspect_len, buffer->inspect_offset, ciflags, diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c index 336edc9204..806aecb641 100644 --- a/src/detect-filemagic.c +++ b/src/detect-filemagic.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2023 Open Information Security Foundation +/* Copyright (C) 2007-2026 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -330,9 +330,11 @@ static uint8_t DetectEngineInspectFilemagic(DetectEngineCtx *de_ctx, DetectEngin continue; } + uint8_t ciflags = DETECT_CI_FLAGS_SINGLE; + ciflags |= buffer->flags; const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, - buffer->inspect, buffer->inspect_len, buffer->inspect_offset, - DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE); + buffer->inspect, buffer->inspect_len, buffer->inspect_offset, ciflags, + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE); if (match) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else { diff --git a/src/detect-filename.c b/src/detect-filename.c index ad5484b641..cf22d6d77b 100644 --- a/src/detect-filename.c +++ b/src/detect-filename.c @@ -1,4 +1,4 @@ -/* Copyright (C) 2007-2022 Open Information Security Foundation +/* Copyright (C) 2007-2026 Open Information Security Foundation * * You can copy, redistribute or modify this Program under the terms of * the GNU General Public License version 2 as published by the Free @@ -265,9 +265,11 @@ static uint8_t DetectEngineInspectFilename(DetectEngineCtx *de_ctx, DetectEngine continue; } + uint8_t ciflags = DETECT_CI_FLAGS_SINGLE; + ciflags |= buffer->flags; const bool match = DetectEngineContentInspection(de_ctx, det_ctx, s, engine->smd, NULL, f, - buffer->inspect, buffer->inspect_len, buffer->inspect_offset, - DETECT_CI_FLAGS_SINGLE, DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE); + buffer->inspect, buffer->inspect_len, buffer->inspect_offset, ciflags, + DETECT_ENGINE_CONTENT_INSPECTION_MODE_STATE); if (match) { return DETECT_ENGINE_INSPECT_SIG_MATCH; } else {