Project

General

Profile

Actions
Copy link

Bug #24

closed
PR OD

Match fails with 2 content, the second of length = 1

Bug #24: Match fails with 2 content, the second of length = 1

Added by Pablo Rincon over 16 years ago. Updated over 16 years ago.

Status:
Closed
Priority:
Normal
Assignee:
OISF Dev
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

The match of two contents in the same rule fail if the second has a length of 1.

Example:
alert tcp any any -> any any (msg:\"Test 32 sig1\"; content:\"0\"; content:\"a\"; sid:1;)
payload: 0123abcde...

Files

0001-Match-content-fail-when-two-contents-are-specified-i.patch (2.03 KB) 0001-Match-content-fail-when-two-contents-are-specified-i.patch Better test it with this unittest Pablo Rincon, 12/27/2009 07:36 PM

PR Updated by Pablo Rincon over 16 years ago Actions
Copy link
 #1

  • File deleted (0001-Unittests-content-matches-10-and-11-fail-with-second.patch)

PR Updated by Pablo Rincon over 16 years ago Actions
Copy link
 #2

The first unittest had "!" as the second content (so it was processed like a negated). This new file use "H" and "i" as contents. And the first word of the payload is Hi.

VJ Updated by Victor Julien over 16 years ago Actions
Copy link
 #3

  • Assignee set to OISF Dev
  • Estimated time set to 2.00 h

VJ Updated by Victor Julien over 16 years ago Actions
Copy link
 #4

  • Status changed from New to Closed

Fixed in most recent master.

Actions
Copy link

Also available in: PDF Atom