Merge pull request #790 in SNORT/snort3 from parser to master

Squashed commit of the following:

commit aaed5f64dd41e0993fcf6116695c72d997efab1f
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Jan 25 09:01:39 2017 -0500

    fix support for content strings with escaped quotes ("foo\"bar")
    thanks to secres@linuxmail.org for reporting the issue

diff --git a/src/parser/parse_utils.cc b/src/parser/parse_utils.cc
index 4cd74698e29f768785af72b9dd6d8b504ea149a5..afd178655e3d13023fb23142d6c14f4914062fea 100644 (file)
--- a/src/parser/parse_utils.cc
+++ b/src/parser/parse_utils.cc
@@ -66,8 +66,11 @@ bool parse_byte_code(const char* in, bool& negate, std::string& out)
             }
         // fall through
         case 1:
-            if ( c == '"' )
+            if ( c == '"' and in[len-1] == '"' )
+            {
+                --len;
                 state = 2;
+            }
             else if ( !isspace(c) )
                 ok = false;
             break;
@@ -78,8 +81,6 @@ bool parse_byte_code(const char* in, bool& negate, std::string& out)
                 nx = 0;
                 state = 4;
             }
-            else if ( c == '"' )
-                state = 9;
             else
                 out += c;
             break;
@@ -110,10 +111,6 @@ bool parse_byte_code(const char* in, bool& negate, std::string& out)
             else if ( !isspace(c) )
                 ok = false;
             break;
-        case 9:
-            if ( !isspace(c) )
-                ok = false;
-            break;
         default:
             assert(false);
         }