From 7d937db5cb87e0ab2ed3c435db109c11ed95e676 Mon Sep 17 00:00:00 2001 From: Shivani Bhardwaj Date: Thu, 21 Mar 2024 14:15:39 +0530 Subject: [PATCH] detect/port: fix grouping of ports w gaps If a single port happens before a range port, the port groups created were incorrect. Fix it to use smarter range check. For example, given, 80:80 - SGH1 100:120 - SGH2 Range created should be 80:80 - SGH1 100:120 - SGH2 Bug 6881 --- src/detect-engine-build.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/detect-engine-build.c b/src/detect-engine-build.c index acbc9fc82d..715c537b37 100644 --- a/src/detect-engine-build.c +++ b/src/detect-engine-build.c @@ -1425,7 +1425,13 @@ static inline int CreatePortList(DetectEngineCtx *de_ctx, const uint8_t *unique_ port = port2 + 1; } else if (p1 && p1->single) { SCPortIntervalFindOverlappingRanges(de_ctx, port, port, &it->tree, list); - port = port + 1; + if ((port2 > port + 1)) { + SCPortIntervalFindOverlappingRanges( + de_ctx, port + 1, port2 - 1, &it->tree, list); + port = port2; + } else { + port = port + 1; + } } else if (p2->single) { /* If port2 is boundary and less or equal to port + 1, create a range * keeping the boundary away as it is single port */ -- 2.47.2