Detect count 5044 v4.5

[catenacyber]

Link to ticket: https://redmine.openinfosecfoundation.org/issues/
https://redmine.openinfosecfoundation.org/issues/5044

Describe changes:

• adds other modes to multi-buffers like all, all_or_absent, matches`, and precise indexing

SV_BRANCH=OISF/suricata-verify#3062

Draft : I would like some approval before doing all the individual modifications for each multi-buffer

#16087 after AI review

High — src/detect-multi.c:37: Invalid arguments leave index_type uninitialized because Rust writes it only after successful parsing. A stale DetectMultiIndexPrecise value dereferences the null sm_ctx at line 77, so a malformed rule can crash startup/reload or acquire unintended semantics. Initialize the discriminator to DetectMultiIndexError, validate context-bearing modes, and test malformed options.

Added *it = DetectMultiIndex::DetectMultiIndexError; in this case

Medium — src/detect-multi.c:63: Modes that can succeed without a content occurrence remain eligible for MPM prefiltering, which suppresses evaluation when no pattern hits. This causes false negatives for empty all_or_absent, zero-match comparisons, and out-of-bounds oob_or; suricata-verify PR 3062 only tests non-empty positive matches. Disable unsafe fast-pattern selection for these modes and add empty-list, zero-match, and OOB coverage.

Changes added in detect-engine-mpm.c

Medium — src/detect-multi.c:77: Negative indexes are accepted and appended despite being logged as unsupported. At EOF the inspector leaves local_id at zero, so index -1 evaluates the first buffer rather than the last. Reject negative indexes or implement reverse indexing, with distinct first/last regression coverage.

Added return -1; after SCLogError

TODOs :

• add support for all multi-buf keywords
• add count support

[suricata-qa]

Information: QA ran without warnings.

Pipeline = 33272

[codecov]

Codecov Report

❌ Patch coverage is 78.50877% with 49 lines in your changes missing coverage. Please review.
✅ Project coverage is 83.01%. Comparing base (acd9d3a) to head (6dfda20).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #16097      +/-   ##
==========================================
- Coverage   83.05%   83.01%   -0.05%     
==========================================
  Files        1004     1005       +1     
  Lines      277359   277557     +198     
==========================================
+ Hits       230370   230409      +39     
- Misses      46989    47148     +159     

Flag	Coverage Δ
fuzzcorpus	61.46% <25.57%> (-0.08%)	⬇️
livemode	18.40% <7.76%> (-0.19%)	⬇️
netns	22.82% <7.76%> (-0.09%)	⬇️
pcap	45.28% <13.24%> (-0.13%)	⬇️
suricata-verify	67.12% <77.62%> (-0.03%)	⬇️
unittests	58.50% <22.80%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[catenacyber]

Replaced by #16100