From 7ef309a21f6a53f570ce49b0606b85ab2e051b40 Mon Sep 17 00:00:00 2001 From: Pablo Rincon Date: Mon, 28 Dec 2009 02:52:41 +0100 Subject: [PATCH] Match content fail when two contents are specified in the same rule and the last of them has length = 1 --- src/detect-content.c | 26 ++++++++++++++++++++++++++ 1 files changed, 26 insertions(+), 0 deletions(-) diff --git a/src/detect-content.c b/src/detect-content.c index 62ee14c..f2944f0 100644 --- a/src/detect-content.c +++ b/src/detect-content.c @@ -2567,6 +2567,30 @@ int DetectContentChunkMatchTest09() return DetectContentChunkMatchTestWrp(sig, 1); } +/** + * \test Check if we match two consecutive simple contents + */ +int DetectContentChunkMatchTest10() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " + " content:\"Hi, this is a big test to check \"; " + " content:\"con\"; " + " sid:1;)"; + return DetectContentChunkMatchTestWrp(sig, 1); +} + +/** + * \test Check if we match two contents of length 1 + */ +int DetectContentChunkMatchTest11() +{ + char *sig = "alert tcp any any -> any any (msg:\"Nothing..\"; " + " content:\"H\"; " + " content:\"i\"; " + " sid:1;)"; + return DetectContentChunkMatchTestWrp(sig, 1); +} + int DetectContentParseTest09(void) { int result = 0; DetectContentData *cd = NULL; @@ -3025,6 +3049,8 @@ void DetectContentRegisterTests(void) UtRegisterTest("DetectContentChunkMatchTest07", DetectContentChunkMatchTest07, 1); UtRegisterTest("DetectContentChunkMatchTest08", DetectContentChunkMatchTest08, 1); UtRegisterTest("DetectContentChunkMatchTest09", DetectContentChunkMatchTest09, 1); + UtRegisterTest("DetectContentChunkMatchTest10", DetectContentChunkMatchTest10, 1); + UtRegisterTest("DetectContentChunkMatchTest11", DetectContentChunkMatchTest11, 1); /* Negated content tests */ UtRegisterTest("SigTest41TestNegatedContent", SigTest41TestNegatedContent, 1); -- 1.6.5