]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect/engine: fix whitelisted port range check
authorShivani Bhardwaj <shivani@oisf.net>
Thu, 16 Nov 2023 08:18:06 +0000 (13:48 +0530)
committerVictor Julien <victor@inliniac.net>
Tue, 5 Dec 2023 10:33:09 +0000 (11:33 +0100)
commit4a00ae6076df94a5096e467ec85896c9d34c6488
tree8868b1dd5df00d3e7e9364233ca2992e23d40484
parent2b73a17bb04b04f5166a7a9cb4947ff1ea5592c5
detect/engine: fix whitelisted port range check

So far, the condition for checking if the whitelisted port was in the
port range of "a" said

a->port >= w->port && a->port2 <= w->port

But, if a->port <= a->port2, this condition could only be true when
a->port == w->port == a->port2. However, the motivation for this fn was
to be able to find if the whitelisted port for a carrier proto already
was in the range of the given protocol and calculate a score for the
port accordingly.
Fix the range check such that a->port <= w->port <= a->port2.
src/detect-engine-build.c