Suricata

When a rule contains buffers with progress values that would cause a byte variable to be used before it is produced, a warning (or error?) should be flagged:

Here's an example rule. http.uri has a lower progress val and would match first but val hasn't been produced yet. file.data has a higher progress value.

  alert http any any -> any any (
      file.data; content:"x"; byte_extract:1,0,val,relative;
      http.uri;  content:"y"; byte_test:1,=,val,0;
      sid:1;)