From: Ken Steele <ken@tilera.com>
Date: Mon, 10 Nov 2014 19:48:29 +0000 (-0500)
Subject: Fix bug in DetectFlowintParse() - Assigning to both parts of a Union
X-Git-Tag: suricata-2.1beta3~137
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=c547d391523b761c67ebd0524ab603e5d8e7bdcc;p=thirdparty%2Fsuricata.git

Fix bug in DetectFlowintParse() - Assigning to both parts of a Union

sfd->target.value was always being set, even if the targettype was
not FLOWINT_TARGET_VAL. This would cause the tvar to be overwritten
with garbage data.
---

diff --git a/src/detect-flowint.c b/src/detect-flowint.c
index 5c3bc193a8..fae82cc4bd 100644
--- a/src/detect-flowint.c
+++ b/src/detect-flowint.c
@@ -322,6 +322,7 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx, char *rawstr)
                             " Values should be between 0 and %"PRIu32, UINT32_MAX);
                 goto error;
             }
+            sfd->target.value = (uint32_t) value_long;
         } else {
             sfd->targettype = FLOWINT_TARGET_VAR;
             sfd->target.tvar.name = SCStrdup(varval);
@@ -342,7 +343,6 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx, char *rawstr)
     }
     if (de_ctx != NULL)
         sfd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWINT);
-    sfd->target.value = (uint32_t) value_long;
     sfd->modifier = modifier;
 
     pcre_free_substring(varname);