From: Jeff Lucovsky <jeff@lucovsky.org>
Date: Mon, 8 Feb 2021 13:06:53 +0000 (-0500)
Subject: detect/pcre: Test capture group/var mismatch
X-Git-Tag: suricata-7.0.0-beta1~1820
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cbb03dbb39d76cf1a2770ef35ba07aac5c3657b5;p=thirdparty%2Fsuricata.git

detect/pcre: Test capture group/var mismatch
---

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 2d4a4dc766..9bff6d044d 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -3552,6 +3552,11 @@ static int DetectPcreParseCaptureTest(void)
     s = DetectEngineAppendSig(de_ctx, "alert http any any -> any any "
             "(content:\"Server: \"; http_header; pcre:\"/([a-z]+)([0-9]+)\\r\\n/HR, flow:somecapture, pkt:anothercap\"; content:\"xyz\"; http_header; sid:3;)");
     FAIL_IF(s == NULL);
+    s = DetectEngineAppendSig(de_ctx,
+            "alert http any any -> any any "
+            "(content:\"Server: \"; http_header; pcre:\"/([a-z]+)\\r\\n/HR, flow:somecapture, "
+            "pkt:anothercap\"; content:\"xyz\"; http_header; sid:3;)");
+    FAIL_IF_NOT_NULL(s);
 
     SigGroupBuild(de_ctx);