Project

General

Profile

Actions

Bug #24

closed

Match fails with 2 content, the second of length = 1

Added by Pablo Rincon almost 12 years ago. Updated almost 12 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

The match of two contents in the same rule fail if the second has a length of 1.

Example:
alert tcp any any -> any any (msg:\"Test 32 sig1\"; content:\"0\"; content:\"a\"; sid:1;)
payload: 0123abcde...


Files

Actions #1

Updated by Pablo Rincon almost 12 years ago

  • File deleted (0001-Unittests-content-matches-10-and-11-fail-with-second.patch)
Actions #2

Updated by Pablo Rincon almost 12 years ago

The first unittest had "!" as the second content (so it was processed like a negated). This new file use "H" and "i" as contents. And the first word of the payload is Hi.

Actions #3

Updated by Victor Julien almost 12 years ago

  • Assignee set to OISF Dev
  • Estimated time set to 2.00 h
Actions #4

Updated by Victor Julien almost 12 years ago

  • Status changed from New to Closed

Fixed in most recent master.

Actions

Also available in: Atom PDF