Project

General

Profile

Actions
Copy link

Bug #24

closed

Match fails with 2 content, the second of length = 1

Added by Pablo Rincon almost 15 years ago. Updated almost 15 years ago.

Status:
Closed
Priority:
Normal
Assignee:
OISF Dev
Target version:
-
Affected Versions:
Effort:
Difficulty:
Label:

Description

The match of two contents in the same rule fail if the second has a length of 1.

Example:
alert tcp any any -> any any (msg:\"Test 32 sig1\"; content:\"0\"; content:\"a\"; sid:1;)
payload: 0123abcde...

Files

0001-Match-content-fail-when-two-contents-are-specified-i.patch (2.03 KB) 0001-Match-content-fail-when-two-contents-are-specified-i.patch Better test it with this unittest Pablo Rincon, 12/27/2009 07:36 PM
Actions
Copy link
 #1

Updated by Pablo Rincon almost 15 years ago

  • File deleted (0001-Unittests-content-matches-10-and-11-fail-with-second.patch)
Actions
Copy link
 #2

Updated by Pablo Rincon almost 15 years ago

The first unittest had "!" as the second content (so it was processed like a negated). This new file use "H" and "i" as contents. And the first word of the payload is Hi.

Actions
Copy link
 #3

Updated by Victor Julien almost 15 years ago

  • Assignee set to OISF Dev
  • Estimated time set to 2.00 h
Actions
Copy link
 #4

Updated by Victor Julien almost 15 years ago

  • Status changed from New to Closed

Fixed in most recent master.

Actions
Copy link

Also available in: Atom PDF