From b58018e7781060f732dedf29f88bcb52a6b41ddb Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Wed, 10 Oct 2018 18:01:48 -0300
Subject: [PATCH] Fix multimatch behavior to match what we have on v2

---
 src/rule.cc | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/src/rule.cc b/src/rule.cc
index 598665a2..3f38f05f 100644
--- a/src/rule.cc
+++ b/src/rule.cc
@@ -362,6 +362,7 @@ inline void Rule::executeTransformation(actions::Action *a,
         if (m_containsMultiMatchAction) {
             std::shared_ptr<std::string> t(new std::string(a->m_name));
             ret->push_back(std::make_pair(u, t));
+            (*nth)++;
         }
         *value = u;
     }
@@ -378,7 +379,6 @@ inline void Rule::executeTransformation(actions::Action *a,
         a->m_name + ": \"" + \
         utils::string::limitTo(80, newValue) +"\"");
 #endif
-    (*nth)++;
 }
 
 
@@ -396,10 +396,7 @@ std::list<std::pair<std::shared_ptr<std::string>,
 
     if (m_containsMultiMatchAction == true) {
         ret.push_back(std::make_pair(
-            std::shared_ptr<std::string>(value),
-            std::shared_ptr<std::string>(new std::string(path))));
-        ret.push_back(std::make_pair(
-            std::shared_ptr<std::string>(value),
+            std::shared_ptr<std::string>(new std::string(*value)),
             std::shared_ptr<std::string>(new std::string(path))));
     }
 
@@ -461,17 +458,16 @@ std::list<std::pair<std::shared_ptr<std::string>,
     }
 
     if (m_containsMultiMatchAction == true) {
-        // v2 checks the last entry twice. Don't know why.
-        ret.push_back(ret.back());
-
 #ifndef NO_LOGS
         trans->debug(9, "multiMatch is enabled. " \
             + std::to_string(ret.size()) + \
             " values to be tested.");
 #endif
-    } else {
+    }
+
+    if (!m_containsMultiMatchAction) {
         ret.push_back(std::make_pair(
-            value,
+            std::shared_ptr<std::string>(new std::string(*value)),
             std::shared_ptr<std::string>(new std::string(path))));
     }