fixed pm backtracking

diff --git a/ChangeLog b/ChangeLog
index d5d29f3dd5947cc9c3aaa97b68360e220556deb1..a7175afc97fbef98b67b1077b86b1da4339c9bd0 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -42,6 +42,7 @@
 -- fix wizard dtor
 -- fixed norm module handling of tcp opts
 -- fixed ecn normalization
+-- fixed pm backtracking
 
 127
 -- REG_TEST out logging tcp options for rebuilt packets to match snort bug

diff --git a/src/detection/detection_options.cc b/src/detection/detection_options.cc
index 493dd9bf11d81a8fe56479912b9279b802d17091..74a4815c55cc17510922f8574b2f6acc4dec3680 100644 (file)
--- a/src/detection/detection_options.cc
+++ b/src/detection/detection_options.cc
@@ -519,7 +519,6 @@ int detection_option_node_evaluate(
             case RULE_OPTION_TYPE_CONTENT:
                 if (node->evaluate)
                 {
-#if 0
                     /* This will be set in the fast pattern matcher if we found
                      * a content and the rule option specifies not that
                      * content. Essentially we've already evaluated this rule
@@ -540,7 +539,6 @@ int detection_option_node_evaluate(
                             break;
                         }
                     }
-#endif
                     rval = node->evaluate(node->option_data, cursor, eval_data->p);
                 }
                 break;

diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc
index cd48fdc5d11337a5d6aa8ca08d2608d7f5151417..7939da4b512857caa622912de6e8916209968ddb 100644 (file)
--- a/src/ips_options/ips_content.cc
+++ b/src/ips_options/ips_content.cc
@@ -377,10 +377,13 @@ static int uniSearchReal(PatternMatchData* pmd, Cursor& c)
 
     int pos = c.get_delta();
 
-    if ( !pos && pmd->relative )
-        pos = c.get_pos();
+    if ( !pos )
+    {
+        if ( pmd->relative )
+            pos = c.get_pos();
 
-    pos += offset;
+        pos += offset;
+    }
 
     if ( pos < 0 )
         pos = 0;