From fdc3f728afd8996115af08655b945f6f6ec1397f Mon Sep 17 00:00:00 2001
From: Gurvinder Singh <gurvindersinghdahiya@gmail.com>
Date: Fri, 14 May 2010 12:04:21 +0200
Subject: [PATCH] set the isdataat keyword when previous sigmatch is either
 content or pcre (bug 144)

---
 src/detect-isdataat.c | 34 +++++++++++++++++++++++-----------
 src/detect-pcre.c     |  5 +++--
 2 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/src/detect-isdataat.c b/src/detect-isdataat.c
index cf9a8389ff..931b5145d0 100644
--- a/src/detect-isdataat.c
+++ b/src/detect-isdataat.c
@@ -40,6 +40,7 @@
 
 #include "util-debug.h"
 #include "util-byte.h"
+#include "detect-pcre.h"
 
 /**
  * \brief Regex for parsing our isdataat options
@@ -248,19 +249,30 @@ int DetectIsdataatSetup (DetectEngineCtx *de_ctx, Signature *s, char *isdataatst
         SigMatch *pm = NULL;
         /** Search for the first previous DetectContent
          * SigMatch (it can be the same as this one) */
-        pm = DetectContentGetLastPattern(s->pmatch_tail);
-        if (pm == NULL) {
-            SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!");
-            return -1;
-        }
+        pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_CONTENT);
+        if (pm != NULL) {
+            cd = (DetectContentData *)pm->ctx;
+            if (cd == NULL) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!");
+                return -1;
+            }
 
-        cd = (DetectContentData *)pm->ctx;
-        if (cd == NULL) {
-            SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!");
-            return -1;
-        }
+            cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
+        } else {
+            pm = SigMatchGetLastSM(s->pmatch_tail, DETECT_PCRE);
+            if (pm == NULL) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!");
+                return -1;
+            }
 
-        cd->flags |= DETECT_CONTENT_RELATIVE_NEXT;
+            DetectPcreData *pe = NULL;
+            pe = (DetectPcreData *) pm->ctx;
+            if (pe == NULL) {
+                SCLogError(SC_ERR_INVALID_SIGNATURE, "Unknown previous keyword!");
+                return -1;
+            }
+            pe->flags |= DETECT_PCRE_RELATIVE;
+        }
     }
 
     sm = SigMatchAlloc();
diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index d5ba14ccdd..a9491cbb79 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -600,6 +600,7 @@ error:
 
 static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexstr)
 {
+    SCEnter();
     DetectPcreData *pd = NULL;
     SigMatch *sm = NULL;
 
@@ -629,12 +630,12 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, char *regexst
     }
 
 
-    return 0;
+    SCReturnInt(0);
 
 error:
     if (pd != NULL) DetectPcreFree(pd);
     if (sm != NULL) SCFree(sm);
-    return -1;
+    SCReturnInt(-1);
 }
 
 void DetectPcreFree(void *ptr) {