detect/urilen: fix applying urilen as depth

If urilen induced depth was set, later DetectContentPropagateLimits()
would apply a wrong depth setting, leading to a false negative in
some cases.

Bug: #5929.

diff --git a/src/detect-urilen.c b/src/detect-urilen.c
index 4a719da7900ffcf73c14ac5b70a2278c463d92cd..6f7c4da2062ccf9e9384fce3e3b26f0d13f06b13 100644 (file)
--- a/src/detect-urilen.c
+++ b/src/detect-urilen.c
@@ -202,6 +202,7 @@ void DetectUrilenApplyToContent(Signature *s, int list)
 
         if (cd->depth == 0 || cd->depth > high) {
             cd->depth = high;
+            cd->flags |= DETECT_CONTENT_DEPTH;
             SCLogDebug("updated %u, content %u to have depth %u "
                     "because of urilen.", s->id, cd->id, cd->depth);
         }