detect: allow 0-sized non-NULL buffers to match

Such as a HTTP1 header with an empty value

Ticket: #6025
pull/8815/head
Philippe Antoine 2 years ago committed by Victor Julien
parent b5fbdc3e5f
commit e80974966d

@ -118,7 +118,8 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
SCReturnInt(0);
}
if (smd == NULL || buffer_len == 0) {
// we want the ability to match on bsize: 0
if (smd == NULL || buffer == NULL) {
KEYWORD_PROFILING_END(det_ctx, smd->type, 0);
SCReturnInt(0);
}

Loading…
Cancel
Save