detect/parse: fix crash on 'internal' keyword use

When keyword __flowvar__postmatch__, an internal keyword, is used
in a rule the 'Setup' func ptr will be NULL. This caused a crash.

diff --git a/src/detect-parse.c b/src/detect-parse.c
index 4663afefbe5fafb8a4ca128a1248e5070e49cc7d..7224bc7ddb33bf28e52ab4698118ca7ddc6b8791 100644 (file)
--- a/src/detect-parse.c
+++ b/src/detect-parse.c
@@ -694,7 +694,7 @@ static int SigParseOptions(DetectEngineCtx *de_ctx, Signature *s, char *optstr,
 
     /* Call option parsing */
     st = SigTableGet(optname);
-    if (st == NULL) {
+    if (st == NULL || st->Setup == NULL) {
         SCLogError(SC_ERR_RULE_KEYWORD_UNKNOWN, "unknown rule keyword '%s'.", optname);
         goto error;
     }