From 8088d6af71a5f2af9eca8f57b91ca162246fc455 Mon Sep 17 00:00:00 2001
From: Victor Hora <vhora@trustwave.com>
Date: Wed, 17 Oct 2018 14:22:44 -0400
Subject: [PATCH] Fix crash in msc_rules_add_file() when using disruptive
 action in child rule inside of chain

---
 CHANGES              | 2 ++
 src/parser/driver.cc | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/CHANGES b/CHANGES
index d26b0564..343c7970 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,8 @@
 v3.0.3 - YYYY-MMM-DD (to be released)
 -------------------------------------
 
+ - Fix crash in msc_rules_add_file() when using disruptive action in chain
+   [Issue #1849 - @victorhora, @zimmerle, @rperper]
  - Fix memory leak in AuditLog::init()
    [Issue #1897 - @weliu]
  - Fix RulesProperties::appendRules()
diff --git a/src/parser/driver.cc b/src/parser/driver.cc
index e942939b..49aaa5a0 100644
--- a/src/parser/driver.cc
+++ b/src/parser/driver.cc
@@ -80,13 +80,13 @@ int Driver::addSecRule(Rule *rule) {
     if (lastRule && lastRule->m_chained) {
         if (lastRule->m_chainedRuleChild == NULL) {
             rule->m_phase = lastRule->m_phase;
-            lastRule->m_chainedRuleChild = rule;
-            rule->m_chainedRuleParent = lastRule;
             if (rule->m_theDisruptiveAction) {
                 m_parserError << "Disruptive actions can only be specified by";
                 m_parserError << " chain starter rules.";
                 return false;
             }
+            lastRule->m_chainedRuleChild = rule;
+            rule->m_chainedRuleParent = lastRule;
             return true;
         } else {
             Rule *a = lastRule->m_chainedRuleChild;