From fe8b2f3d2a32b927c718fd4c38df196fa5d05cae Mon Sep 17 00:00:00 2001 From: William Bland Date: Fri, 4 Sep 2026 09:52:44 -0400 Subject: [PATCH] detect/analyzer: fix swapped output file pointers EngineAnalysisFP(), CleanupFPAnalyzer(), and CleanupRuleAnalyzer() were writing to and closing the wrong FILE* pointers. Fast pattern output was written to rules_analysis.txt instead of rules_fast_pattern.txt, leaving the latter effectively empty. Restore the behavior from before c8615bcd4, which inadvertently swapped the pointers. Bug: #9007 --- src/detect-engine-analyzer.c | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c index b077916972..bf6c5cab10 100644 --- a/src/detect-engine-analyzer.c +++ b/src/detect-engine-analyzer.c @@ -193,7 +193,7 @@ void EngineAnalysisFP(const DetectEngineCtx *de_ctx, const Signature *s, const c } } - FILE *fp = de_ctx->ea->rule_engine_analysis_fp; + FILE *fp = de_ctx->ea->fp_engine_analysis_fp; fprintf(fp, "== Sid: %u ==\n", s->id); fprintf(fp, "%s\n", line); @@ -446,7 +446,10 @@ static int SetupRuleAnalyzer(DetectEngineCtx *de_ctx) static void CleanupFPAnalyzer(DetectEngineCtx *de_ctx) { - FILE *fp = de_ctx->ea->rule_engine_analysis_fp; + FILE *fp = de_ctx->ea->fp_engine_analysis_fp; + if (fp == NULL) { + return; + } fprintf(fp, "============\n" "Summary:\n============\n"); @@ -462,15 +465,15 @@ static void CleanupFPAnalyzer(DetectEngineCtx *de_ctx) (float)((double)f->tot / (float)f->cnt)); } - fclose(de_ctx->ea->rule_engine_analysis_fp); - de_ctx->ea->rule_engine_analysis_fp = NULL; + fclose(de_ctx->ea->fp_engine_analysis_fp); + de_ctx->ea->fp_engine_analysis_fp = NULL; } static void CleanupRuleAnalyzer(DetectEngineCtx *de_ctx) { - if (de_ctx->ea->fp_engine_analysis_fp != NULL) { - fclose(de_ctx->ea->fp_engine_analysis_fp); - de_ctx->ea->fp_engine_analysis_fp = NULL; + if (de_ctx->ea->rule_engine_analysis_fp != NULL) { + fclose(de_ctx->ea->rule_engine_analysis_fp); + de_ctx->ea->rule_engine_analysis_fp = NULL; } if (de_ctx->ea->percent_re != NULL) { pcre2_code_free(de_ctx->ea->percent_re);