filestore: fix a case where a matching non-filestore sig could trigger the store...

diff --git a/src/detect.c b/src/detect.c
index d14824eee73f9a02c51a29084b32fa0f53960f3c..8fbbafa77bf311079b9e2b9069e448753744cd9a 100644 (file)
--- a/src/detect.c
+++ b/src/detect.c
@@ -1040,7 +1040,9 @@ static int SigMatchSignaturesRunPostMatch(ThreadVars *tv,
 
     DetectReplaceExecute(p, det_ctx->replist);
     det_ctx->replist = NULL;
-    DetectFilestorePostMatch(tv, det_ctx,p);
+
+    if (s->flags & SIG_FLAG_FILESTORE)
+        DetectFilestorePostMatch(tv, det_ctx, p);
 
     return 1;
 }
@@ -1865,6 +1867,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
 next:
         DetectReplaceFree(det_ctx->replist);
         det_ctx->replist = NULL;
+        det_ctx->filestore_sm = NULL;
         RULE_PROFILING_END(det_ctx, s, smatch);
 
         det_ctx->flags = 0;