From: Russ Combs (rucombs) <rucombs@cisco.com>
Date: Fri, 27 Jan 2017 15:42:34 +0000 (-0500)
Subject: Merge pull request #790 in SNORT/snort3 from parser to master
X-Git-Tag: 3.0.0-233~98
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c2e4308de01700cfcfbf7acc74bd44279879fa16;p=thirdparty%2Fsnort3.git

Merge pull request #790 in SNORT/snort3 from parser to master

Squashed commit of the following:

commit aaed5f64dd41e0993fcf6116695c72d997efab1f
Author: Russ Combs <rucombs@cisco.com>
Date:   Wed Jan 25 09:01:39 2017 -0500

    fix support for content strings with escaped quotes ("foo\"bar")
    thanks to secres@linuxmail.org for reporting the issue
---

diff --git a/src/parser/parse_utils.cc b/src/parser/parse_utils.cc
index 4cd74698e..afd178655 100644
--- a/src/parser/parse_utils.cc
+++ b/src/parser/parse_utils.cc
@@ -66,8 +66,11 @@ bool parse_byte_code(const char* in, bool& negate, std::string& out)
             }
         // fall through
         case 1:
-            if ( c == '"' )
+            if ( c == '"' and in[len-1] == '"' )
+            {
+                --len;
                 state = 2;
+            }
             else if ( !isspace(c) )
                 ok = false;
             break;
@@ -78,8 +81,6 @@ bool parse_byte_code(const char* in, bool& negate, std::string& out)
                 nx = 0;
                 state = 4;
             }
-            else if ( c == '"' )
-                state = 9;
             else
                 out += c;
             break;
@@ -110,10 +111,6 @@ bool parse_byte_code(const char* in, bool& negate, std::string& out)
             else if ( !isspace(c) )
                 ok = false;
             break;
-        case 9:
-            if ( !isspace(c) )
-                ok = false;
-            break;
         default:
             assert(false);
         }