From: Victor Julien <victor@inliniac.net>
Date: Thu, 18 Oct 2018 17:06:28 +0000 (+0200)
Subject: detect/analyzer: fix json analyzer being called on incomplete rules
X-Git-Tag: suricata-4.1.0~69
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c05459ce89ecb5007d486f9425d843c82a9147aa;p=thirdparty%2Fsuricata.git

detect/analyzer: fix json analyzer being called on incomplete rules
---

diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c
index a0b632480f..82142f801c 100644
--- a/src/detect-engine-build.c
+++ b/src/detect-engine-build.c
@@ -1830,6 +1830,7 @@ int SigAddressPrepareStage4(DetectEngineCtx *de_ctx)
     SCReturnInt(0);
 }
 
+extern int rule_engine_analysis_set;
 /** \internal
  *  \brief perform final per signature setup tasks
  *
@@ -1855,6 +1856,11 @@ static int SigMatchPrepare(DetectEngineCtx *de_ctx)
             SigMatch *sm = s->init_data->smlists[type];
             s->sm_arrays[type] = SigMatchList2DataArray(sm);
         }
+        if (rule_engine_analysis_set) {
+#ifdef HAVE_LIBJANSSON
+            EngineAnalysisRules2(de_ctx, s);
+#endif
+        }
         /* free lists. Ctx' are xferred to sm_arrays so won't get freed */
         uint32_t i;
         for (i = 0; i < s->init_data->smlists_array_size; i++) {
diff --git a/src/detect-engine-loader.c b/src/detect-engine-loader.c
index 235a997350..b27bf7f999 100644
--- a/src/detect-engine-loader.c
+++ b/src/detect-engine-loader.c
@@ -50,7 +50,7 @@
 extern int rule_reload;
 extern int engine_analysis;
 static int fp_engine_analysis_set = 0;
-static int rule_engine_analysis_set = 0;
+int rule_engine_analysis_set = 0;
 
 /**
  *  \brief Create the path if default-rule-path was specified
@@ -175,9 +175,6 @@ static int DetectLoadSigFile(DetectEngineCtx *de_ctx, char *sig_file,
                 }
                 if (rule_engine_analysis_set) {
                     EngineAnalysisRules(de_ctx, sig, line);
-#ifdef HAVE_LIBJANSSON
-                    EngineAnalysisRules2(de_ctx, sig);
-#endif
                 }
             }
             SCLogDebug("signature %"PRIu32" loaded", sig->id);