Bug #24
closed
Match fails with 2 content, the second of length = 1
Added by Pablo Rincon over 14 years ago.
Updated over 14 years ago.
Description
The match of two contents in the same rule fail if the second has a length of 1.
Example:
alert tcp any any -> any any (msg:\"Test 32 sig1\"; content:\"0\"; content:\"a\"; sid:1;)
payload: 0123abcde...
Files
- File deleted (
0001-Unittests-content-matches-10-and-11-fail-with-second.patch)
The first unittest had "!" as the second content (so it was processed like a negated). This new file use "H" and "i" as contents. And the first word of the payload is Hi.
- Assignee set to OISF Dev
- Estimated time set to 2.00 h
- Status changed from New to Closed
Fixed in most recent master.
Also available in: Atom
PDF