From: Duarte Silva <development@serializing.me>
Date: Fri, 12 Dec 2014 18:21:24 +0000 (+0000)
Subject: Fix and improvements
X-Git-Tag: suricata-2.1beta3~91
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e586644c254a5b2b71e5e3dd847c7fd7ea264352;p=thirdparty%2Fsuricata.git

Fix and improvements
- Added/removed missing/superfluous util-memrchr.h include
- Improved the extraction of a IP from the XFF chain of IPs
---

diff --git a/src/alert-unified2-alert.c b/src/alert-unified2-alert.c
index 4bfea39770..26bacb28cc 100644
--- a/src/alert-unified2-alert.c
+++ b/src/alert-unified2-alert.c
@@ -69,8 +69,6 @@
 
 #include "util-optimize.h"
 
-#include "util-memrchr.h"
-
 #ifndef IPPROTO_SCTP
 #define IPPROTO_SCTP 132
 #endif
diff --git a/src/app-layer-htp-xff.c b/src/app-layer-htp-xff.c
index 9337ba18f7..5be84bbdb7 100644
--- a/src/app-layer-htp-xff.c
+++ b/src/app-layer-htp-xff.c
@@ -30,6 +30,7 @@
 #include "app-layer-htp-xff.h"
 
 #include "util-misc.h"
+#include "util-memrchr.h"
 
 /** XFF header value minimal length */
 #define XFF_CHAIN_MINLEN 7
@@ -94,7 +95,7 @@ int HttpXFFGetIPFromTx(const Packet *p, uint64_t tx_id, HttpXFFCfg *xff_cfg,
             /** Get the first IP address from the chain */
             p_xff = memchr(xff_chain, ',', bstr_len(h_xff->value));
             if (p_xff != NULL) {
-                xff_chain[bstr_len(h_xff->value) - strlen((char *)p_xff)]=0;
+                xff_chain[bstr_len(h_xff->value) - (p_xff - xff_chain)]=0;
             }
             p_xff = xff_chain;
         }