detect: allow 0-sized non-NULL buffers to match

Such as a HTTP1 header with an empty value

Ticket: #6025

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index f639b4f81fa96681fa137cebe2f22b891c6ee072..edb7804b24a2242bedfcc235137e74bdcfe8dce6 100644 (file)
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -118,7 +118,8 @@ uint8_t DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThrea
         SCReturnInt(0);
     }
 
-    if (smd == NULL || buffer_len == 0) {
+    // we want the ability to match on bsize: 0
+    if (smd == NULL || buffer == NULL) {
         KEYWORD_PROFILING_END(det_ctx, smd->type, 0);
         SCReturnInt(0);
     }