detect-engine: use flag SIG_FLAG_MPM_NEG

The flag SIG_FLAG_MPM_NEG is set before whitelisting the rules. Make it
better by checking for the flag in the beginning and return immediately.

diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index 71c2983fc421c0a413f1d497091cdc69779e9969..70611df46f5c67159e544db124e872ede180557f 100644 (file)
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -620,6 +620,8 @@ static int RuleGetMpmPatternSize(const Signature *s)
 
 static bool RuleMpmIsNegated(const Signature *s)
 {
+    if (s->flags & SIG_FLAG_MPM_NEG)
+        return true;
     if (s->init_data->mpm_sm == NULL)
         return false;
     int mpm_list = s->init_data->mpm_sm_list;