detect: Improve handling of variable values

When one of offset/depth/distance is from a variable, adjust the depth
by the offset as is done with scalar values at parse time.
pull/4393/head
Jeff Lucovsky 6 years ago committed by Victor Julien
parent db8527e7b3
commit f318a46d34

@ -247,6 +247,13 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
prev_buffer_offset = 0;
}
/* If the value came from a variable, make sure to adjust the depth so it's relative
* to the offset value.
*/
if (cd->flags & (DETECT_CONTENT_DISTANCE_BE|DETECT_CONTENT_OFFSET_BE|DETECT_CONTENT_DEPTH_BE)) {
depth += offset;
}
/* update offset with prev_offset if we're searching for
* matches after the first occurence. */
SCLogDebug("offset %"PRIu32", prev_offset %"PRIu32, offset, prev_offset);

Loading…
Cancel
Save