detect: fix check for app_layer events

Ticket: 7106
(cherry picked from commit 4e584ed20165f2af32f13f75d71f64ff24bafc5b)

diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index a71f1451ca17bc65518dcfd61cb19d4bf485b4ef..894e4baea8d2ce7050831590035d5fb0b30e31d4 100644 (file)
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -37,6 +37,7 @@
 #include "detect-flow.h"
 #include "detect-config.h"
 #include "detect-flowbits.h"
+#include "app-layer-events.h"
 
 #include "util-port-interval-tree.h"
 #include "util-profiling.h"
@@ -410,7 +411,8 @@ PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto,
         (*mask) |= SIG_MASK_REQUIRE_NO_PAYLOAD;
     }
 
-    if (p->events.cnt > 0 || app_decoder_events != 0 || p->app_layer_events != NULL) {
+    if (p->events.cnt > 0 || app_decoder_events != 0 ||
+            (p->app_layer_events != NULL && p->app_layer_events->cnt)) {
         SCLogDebug("packet/flow has events set");
         (*mask) |= SIG_MASK_REQUIRE_ENGINE_EVENT;
     }