From 8c9b3bd3aebfe71fc6a7c4b1c3f5c45d9c3776e8 Mon Sep 17 00:00:00 2001
From: Jon Siwek <jsiwek@corelight.com>
Date: Tue, 27 Aug 2019 16:16:39 -0700
Subject: [PATCH] GH-554: remove use of file magic in protocol-based signature
 logic

This can be a significant performance/memory improvement since
otherwise the protocol-based rule matching logic ends up superfluously
creating file-matching state per file-matcher per connection/endpoint.
---
 src/RuleMatcher.cc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/RuleMatcher.cc b/src/RuleMatcher.cc
index 88779f0050..340e6d5098 100644
--- a/src/RuleMatcher.cc
+++ b/src/RuleMatcher.cc
@@ -732,7 +732,7 @@ RuleEndpointState* RuleMatcher::InitEndpoint(analyzer::Analyzer* analyzer,
 		// pattern matching to do.
 		if ( hdr_test->level <= RE_level )
 			{
-			for ( int i = 0; i < Rule::TYPES; ++i )
+			for ( int i = Rule::PAYLOAD; i < Rule::TYPES; ++i )
 				{
 				for ( const auto& set : hdr_test->psets[i] )
 					{