From: Victor Julien <vjulien@oisf.net>
Date: Thu, 23 Mar 2023 14:42:18 +0000 (+0100)
Subject: detect/urilen: fix applying urilen as depth
X-Git-Tag: suricata-7.0.0-rc2~503
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ba7db2583b0d96627d3088dd3d89b69ad21ff757;p=thirdparty%2Fsuricata.git

detect/urilen: fix applying urilen as depth

If urilen induced depth was set, later DetectContentPropagateLimits()
would apply a wrong depth setting, leading to a false negative in
some cases.

Bug: #5929.
---

diff --git a/src/detect-urilen.c b/src/detect-urilen.c
index 4a719da790..6f7c4da206 100644
--- a/src/detect-urilen.c
+++ b/src/detect-urilen.c
@@ -202,6 +202,7 @@ void DetectUrilenApplyToContent(Signature *s, int list)
 
         if (cd->depth == 0 || cd->depth > high) {
             cd->depth = high;
+            cd->flags |= DETECT_CONTENT_DEPTH;
             SCLogDebug("updated %u, content %u to have depth %u "
                     "because of urilen.", s->id, cd->id, cd->depth);
         }