Suricata

A port or address string which is negated more than once is parsed incorrectly. For example a port string of

80] should be parsed 80. The same applies for addresses too.

The functions DetectPortParseDo() and DetectAddressParse2() while handling negated values, don't take into account the negated(!) count with depth. This can be handled by incrementing and decrementing a count for the ! symbol on parsing the port and address and passing this value recursively to the above function. A mod 2 of this count indicates it's not negated, else it's negated.