From 4e584ed20165f2af32f13f75d71f64ff24bafc5b Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Wed, 19 Jun 2024 13:39:08 +0200 Subject: [PATCH] detect: fix check for app_layer events Ticket: 7106 --- src/detect-engine-build.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c index f4bc4b653b..8f292025a3 100644 --- a/src/detect-engine-build.c +++ b/src/detect-engine-build.c @@ -37,6 +37,7 @@ #include "detect-flow.h" #include "detect-config.h" #include "detect-flowbits.h" +#include "app-layer-events.h" #include "util-port-interval-tree.h" #include "util-profiling.h" @@ -420,7 +421,8 @@ PacketCreateMask(Packet *p, SignatureMask *mask, AppProto alproto, (*mask) |= SIG_MASK_REQUIRE_NO_PAYLOAD; } - if (p->events.cnt > 0 || app_decoder_events != 0 || p->app_layer_events != NULL) { + if (p->events.cnt > 0 || app_decoder_events != 0 || + (p->app_layer_events != NULL && p->app_layer_events->cnt)) { SCLogDebug("packet/flow has events set"); (*mask) |= SIG_MASK_REQUIRE_ENGINE_EVENT; } -- 2.47.2