doc/byte_math: Add divide by 0 discussion.

Issue: 5945
victorjulien · Apr 12, 2023 · fd46c93 · fd46c93
1 parent 38c5e89
commit fd46c93
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 0 deletions.
diff --git a/doc/userguide/rules/differences-from-snort.rst b/doc/userguide/rules/differences-from-snort.rst
@@ -276,6 +276,8 @@ See :doc:`http-keywords` for all HTTP keywords.
    uint32 value. Snort rejects ``rvalue`` values of ``0`` and requires
    values to be between ``[1..max-uint32 value]``.
 
+- Suricata will never match if there's a zero divisor. Division by 0 is undefined.
+
 
 ``isdataat`` Keyword
 --------------------

diff --git a/doc/userguide/rules/payload-keywords.rst b/doc/userguide/rules/payload-keywords.rst
@@ -441,6 +441,8 @@ an existing variable or a specified value.
 
 When ``relative`` is included, there must be a previous ``content`` or ``pcre`` match.
 
+Note: if ``oper`` is ``/`` and the divisor is 0, there will never be a match on the ``byte_math`` keyword.
+
 The result can be stored in a result variable and referenced by
 other rule options later in the rule.