From: rcombs <rcombs@sq18.sfeng.sourcefire.com>
Date: Wed, 19 Nov 2014 12:52:02 +0000 (-0500)
Subject: fixed pm backtracking
X-Git-Tag: 3.0.0-233~1189^2~12
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=620715eafe9687afd67c73b050f85fc374f50e26;p=thirdparty%2Fsnort3.git

fixed pm backtracking
---

diff --git a/ChangeLog b/ChangeLog
index d5d29f3dd..a7175afc9 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -42,6 +42,7 @@
 -- fix wizard dtor
 -- fixed norm module handling of tcp opts
 -- fixed ecn normalization
+-- fixed pm backtracking
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug
diff --git a/src/detection/detection_options.cc b/src/detection/detection_options.cc
index 493dd9bf1..74a4815c5 100644
--- a/src/detection/detection_options.cc
+++ b/src/detection/detection_options.cc
@@ -519,7 +519,6 @@ int detection_option_node_evaluate(
             case RULE_OPTION_TYPE_CONTENT:
                 if (node->evaluate)
                 {
-#if 0
                     /* This will be set in the fast pattern matcher if we found
                      * a content and the rule option specifies not that
                      * content. Essentially we've already evaluated this rule
@@ -540,7 +539,6 @@ int detection_option_node_evaluate(
                             break;
                         }
                     }
-#endif
                     rval = node->evaluate(node->option_data, cursor, eval_data->p);
                 }
                 break;
diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc
index cd48fdc5d..7939da4b5 100644
--- a/src/ips_options/ips_content.cc
+++ b/src/ips_options/ips_content.cc
@@ -377,10 +377,13 @@ static int uniSearchReal(PatternMatchData* pmd, Cursor& c)
 
     int pos = c.get_delta();
 
-    if ( !pos && pmd->relative )
-        pos = c.get_pos();
+    if ( !pos )
+    {
+        if ( pmd->relative )
+            pos = c.get_pos();
 
-    pos += offset;
+        pos += offset;
+    }
 
     if ( pos < 0 )
         pos = 0;