From 1c7aa89228f3946eded41cfb8ed65cd003e98f2a Mon Sep 17 00:00:00 2001
From: apocelipes <seve3r@outlook.com>
Date: Tue, 6 May 2025 18:49:29 +0800
Subject: [PATCH] TerminalShell: use ffBinaryExtractStrings result as possible
 (#1739)

---
 src/detection/terminalshell/terminalshell.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index f4c8a076e..d8cc0cd7e 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -69,6 +69,7 @@ static bool getShellVersionBash(FFstrbuf* exe, FFstrbuf* exePath, FFstrbuf* vers
     if (*path == '\0')
         path = exe->chars;
     ffBinaryExtractStrings(path, extractBashVersion, version, (uint32_t) strlen("@(#)Bash version 0.0.0(0) release GNU"));
+    if (version->length > 0) return true;
 
     if(!getExeVersionRaw(exe, version))
         return false;