fix for bug #574.

More of a temporary solution to prevent any possible FPs.  Disable content
inspection bypass for mpm patterns.

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index 6956052f148fd0ea3b8e15ad3dbfbab985c13bea..2546f7daeb5f262a83bb1d63c3114ddcc76c59be 100644 (file)
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -116,9 +116,9 @@ int DetectEngineContentInspection(DetectEngineCtx *de_ctx, DetectEngineThreadCtx
         /* we might have already have this content matched by the mpm.
          * (if there is any other reason why we'd want to avoid checking
          *  it here, please fill it in) */
-        if (cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED) {
-            goto match;
-        }
+        //if (cd->flags & DETECT_CONTENT_NO_DOUBLE_INSPECTION_REQUIRED) {
+        //    goto match;
+        //}
 
         /* rule parsers should take care of this */
 #ifdef DEBUG