From e0d7f64a14ca075dde598a0aadb4daf325edc1db Mon Sep 17 00:00:00 2001
From: Victor Julien <victor@inliniac.net>
Date: Wed, 2 Nov 2011 16:38:47 +0100
Subject: [PATCH] Fix thresholding code suppressing an alert if no
 threshold/suppress rules needed to be checked.

---
 src/detect-engine-alert.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index aee5bbf41e..bf30cbed89 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -59,12 +59,14 @@ PacketAlert *PacketAlertGetTag(void) {
  * \param sig Signature pointer
  * \param p Packet structure
  *
+ * \retval 1 alert is not suppressed
+ * \retval 0 alert is suppressed
  */
 static int PacketAlertHandle(DetectEngineCtx *de_ctx, DetectEngineThreadCtx *det_ctx,
                        Signature *s, Packet *p, uint16_t pos)
 {
     SCEnter();
-    int ret = 0;
+    int ret = 1;
     DetectThresholdData *td = NULL;
     SigMatch *sm = NULL;