From: Victor Julien <vjulien@oisf.net>
Date: Thu, 23 Mar 2023 14:42:18 +0000 (+0100)
Subject: detect/urilen: fix applying urilen as depth
X-Git-Tag: suricata-6.0.11~51
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7838fc8b828bfb003b57403104a97f6ebf5357b5;p=thirdparty%2Fsuricata.git

detect/urilen: fix applying urilen as depth

If urilen induced depth was set, later DetectContentPropagateLimits()
would apply a wrong depth setting, leading to a false negative in
some cases.

Bug: #5929.
(cherry picked from commit ba7db2583b0d96627d3088dd3d89b69ad21ff757)
---

diff --git a/src/detect-urilen.c b/src/detect-urilen.c
index 0a507840ec..efe0afe26d 100644
--- a/src/detect-urilen.c
+++ b/src/detect-urilen.c
@@ -336,6 +336,7 @@ void DetectUrilenApplyToContent(Signature *s, int list)
 
         if (cd->depth == 0 || cd->depth > high) {
             cd->depth = (uint16_t)high;
+            cd->flags |= DETECT_CONTENT_DEPTH;
             SCLogDebug("updated %u, content %u to have depth %u "
                     "because of urilen.", s->id, cd->id, cd->depth);
         }