From: Victor Julien <victor@inliniac.net>
Date: Wed, 31 Oct 2012 10:22:53 +0000 (+0100)
Subject: filestore: fix a case where a matching non-filestore sig could trigger the store... 
X-Git-Tag: suricata-1.4beta3~55
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a3f963f6304c5d4f0021f15d466d6d9332ade553;p=thirdparty%2Fsuricata.git

filestore: fix a case where a matching non-filestore sig could trigger the store of a partially matching filestore sig.
---

diff --git a/src/detect.c b/src/detect.c
index d14824eee7..8fbbafa77b 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -1040,7 +1040,9 @@ static int SigMatchSignaturesRunPostMatch(ThreadVars *tv,
 
     DetectReplaceExecute(p, det_ctx->replist);
     det_ctx->replist = NULL;
-    DetectFilestorePostMatch(tv, det_ctx,p);
+
+    if (s->flags & SIG_FLAG_FILESTORE)
+        DetectFilestorePostMatch(tv, det_ctx, p);
 
     return 1;
 }
@@ -1865,6 +1867,7 @@ int SigMatchSignatures(ThreadVars *th_v, DetectEngineCtx *de_ctx, DetectEngineTh
 next:
         DetectReplaceFree(det_ctx->replist);
         det_ctx->replist = NULL;
+        det_ctx->filestore_sm = NULL;
         RULE_PROFILING_END(det_ctx, s, smatch);
 
         det_ctx->flags = 0;