detect/analyzer: print int keyword values correctly

To avoid negative values to be misrepresented.

Bug: #6615.

diff --git a/src/detect-engine-analyzer.c b/src/detect-engine-analyzer.c
index 0eda31b2fc4ab0d34a2d9c8043261368f562391c..b936ba1e0c38a3ae8a9c9496ccd41d48f0f500b6 100644 (file)
--- a/src/detect-engine-analyzer.c
+++ b/src/detect-engine-analyzer.c
@@ -703,10 +703,10 @@ static void DumpContent(JsonBuilder *js, const DetectContentData *cd)
         jb_set_uint(js, "depth", cd->depth);
     }
     if (cd->flags & DETECT_CONTENT_DISTANCE) {
-        jb_set_uint(js, "distance", cd->distance);
+        jb_set_int(js, "distance", cd->distance);
     }
     if (cd->flags & DETECT_CONTENT_WITHIN) {
-        jb_set_uint(js, "within", cd->within);
+        jb_set_int(js, "within", cd->within);
     }
     jb_set_bool(js, "fast_pattern", cd->flags & DETECT_CONTENT_FAST_PATTERN);
     jb_set_bool(js, "relative_next", cd->flags & DETECT_CONTENT_RELATIVE_NEXT);
@@ -779,9 +779,9 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
 
                 jb_open_object(js, "byte_jump");
                 jb_set_uint(js, "nbytes", cd->nbytes);
-                jb_set_uint(js, "offset", cd->offset);
+                jb_set_int(js, "offset", cd->offset);
                 jb_set_uint(js, "multiplier", cd->multiplier);
-                jb_set_uint(js, "post_offset", cd->post_offset);
+                jb_set_int(js, "post_offset", cd->post_offset);
                 switch (cd->base) {
                     case DETECT_BYTEJUMP_BASE_UNSET:
                         jb_set_string(js, "base", "unset");
@@ -824,7 +824,7 @@ static void DumpMatches(RuleAnalyzer *ctx, JsonBuilder *js, const SigMatchData *
 
                 jb_open_object(js, "byte_test");
                 jb_set_uint(js, "nbytes", cd->nbytes);
-                jb_set_uint(js, "offset", cd->offset);
+                jb_set_int(js, "offset", cd->offset);
                 switch (cd->base) {
                     case DETECT_BYTETEST_BASE_UNSET:
                         jb_set_string(js, "base", "unset");