From: Zopieux <Zopieux@users.noreply.github.com>
Date: Thu, 18 Jun 2015 09:26:53 +0000 (+0200)
Subject: stream_size operator comparison (fix issue #1488)
X-Git-Tag: suricata-3.0RC1~274
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cd038419fdea04542c57a38c55f7147ca1839fca;p=thirdparty%2Fsuricata.git

stream_size operator comparison (fix issue #1488)

`DetectStreamSizeParse` was first checking if mode[0] is '<', which is true for both '<' and '<=', thus '<=' (and resp. '>=') is never matched. This patch does the `strcmp` to '<=' (resp. '>=') within the if block of '<' (resp. '>') to fix #1488.
---

diff --git a/src/detect-stream_size.c b/src/detect-stream_size.c
index bec2edce6e..c3eaad90f0 100644
--- a/src/detect-stream_size.c
+++ b/src/detect-stream_size.c
@@ -244,19 +244,19 @@ DetectStreamSizeData *DetectStreamSizeParse (char *streamstr)
     if (strlen(mode) == 0)
         goto error;
 
-    if (mode[0] == '<')
+    if (mode[0] == '=') {
+        sd->mode = DETECTSSIZE_EQ;
+    } else if (mode[0] == '<') {
         sd->mode = DETECTSSIZE_LT;
-    else if (strcmp("<=", mode) == 0)
-        sd->mode = DETECTSSIZE_LEQ;
-    else if (mode[0] == '>')
+        if (strcmp("<=", mode) == 0)
+            sd->mode = DETECTSSIZE_LEQ;
+    } else if (mode[0] == '>') {
         sd->mode = DETECTSSIZE_GT;
-    else if (strcmp(">=", mode) == 0)
-        sd->mode = DETECTSSIZE_GEQ;
-    else if (strcmp("!=", mode) == 0)
+        if (strcmp(">=", mode) == 0)
+            sd->mode = DETECTSSIZE_GEQ;
+    } else if (strcmp("!=", mode) == 0) {
         sd->mode = DETECTSSIZE_NEQ;
-    else if (mode[0] == '=')
-        sd->mode = DETECTSSIZE_EQ;
-    else {
+    } else {
         SCLogError(SC_ERR_INVALID_OPERATOR, "Invalid operator");
         goto error;
     }