From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 19 Jun 2024 11:39:08 +0000 (+0200)
Subject: detect: fix check for app_layer events
X-Git-Tag: suricata-7.0.6~5
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0ed4d29d4239eb3f0ea4a806fe40e4742d4292a9;p=thirdparty%2Fsuricata.git

detect: fix check for app_layer events

Ticket: 7106
(cherry picked from commit 4e584ed20165f2af32f13f75d71f64ff24bafc5b)
---

diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index a71f1451ca..894e4baea8 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -37,6 +37,7 @@
 #include "detect-flow.h"
 #include "detect-config.h"
 #include "detect-flowbits.h"
+#include "app-layer-events.h"
 
 #include "util-port-interval-tree.h"
 #include "util-profiling.h"
@@ -410,7 +411,8 @@ PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto,
         (*mask) |= SIG_MASK_REQUIRE_NO_PAYLOAD;
     }
 
-    if (p->events.cnt > 0 || app_decoder_events != 0 || p->app_layer_events != NULL) {
+    if (p->events.cnt > 0 || app_decoder_events != 0 ||
+            (p->app_layer_events != NULL && p->app_layer_events->cnt)) {
         SCLogDebug("packet/flow has events set");
         (*mask) |= SIG_MASK_REQUIRE_ENGINE_EVENT;
     }