From ed0a338eab66a6081a31170dd6386abee154661e Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 25 Aug 2026 15:05:01 +0200 Subject: [PATCH] detect/multi: handle "all" case for transformed multi-buffers Ticket: 5044 As we set "all" before adding a transform, we must take care of this case `sticky_multi: all; transform; content: "abc";` so that "all" applies to the transformed multi-buffer --- src/detect-engine-buffer.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/detect-engine-buffer.c b/src/detect-engine-buffer.c index 9041315af1..2a682eb765 100644 --- a/src/detect-engine-buffer.c +++ b/src/detect-engine-buffer.c @@ -134,10 +134,22 @@ int DetectBufferGetActiveList(DetectEngineCtx *de_ctx, Signature *s) s->init_data->transforms.cnt = 0; if (s->init_data->curbuf && s->init_data->curbuf->head != NULL) { + const SigMatch *sm = s->init_data->curbuf->head; + if (sm != NULL && sm->next == NULL && + (sm->type == DETECT_MULTI_ALL || sm->type == DETECT_MULTI_ALL_OR_ABSENT || + sm->type == DETECT_MULTI_NB || sm->type == DETECT_MULTI_INDEX || + sm->type == DETECT_ABSENT)) { + // just keep the same curbuf in case sticky_multi: all; transform; content: "abc"; + // but update its id to the transfomed id + s->init_data->curbuf->id = new_list; + SCReturnInt(0); + } + if (SignatureInitDataBufferCheckExpand(s) < 0) { SCLogError("failed to expand rule buffer array"); return -1; } + s->init_data->curbuf = &s->init_data->buffers[s->init_data->buffer_index++]; s->init_data->curbuf->multi_capable = DetectEngineBufferTypeSupportsMultiInstanceGetById(de_ctx, base_list);