From bf1af71d032c192e988d0e6448e83e414d280089 Mon Sep 17 00:00:00 2001
From: Carter Li <zhangsongcui@live.cn>
Date: Fri, 10 Jul 2026 21:47:31 +0800
Subject: [PATCH] Shell (Linux): fixes a potiential fish version detection
 error

---
 src/detection/terminalshell/terminalshell.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/detection/terminalshell/terminalshell.c b/src/detection/terminalshell/terminalshell.c
index 911b34dfb..97cb9c3ef 100644
--- a/src/detection/terminalshell/terminalshell.c
+++ b/src/detection/terminalshell/terminalshell.c
@@ -89,7 +89,8 @@ static bool getShellVersionFish(FFstrbuf* exe, FFstrbuf* version) {
     if (version->length < strlen("fish, v") || !ffStrbufStartsWithS(version, "fish")) {
         return false;
     }
-    uint32_t index = ffStrbufNextIndexC(version, strlen("fish, "), ' ');
+    uint32_t index = ffStrbufFirstIndexC(version, ' '); // skip "fish,"
+    index = ffStrbufNextIndexC(version, index + 1, ' '); // skip "version"
     ffStrbufSubstrAfter(version, index);
     ffStrbufSubstrBeforeFirstC(version, ' ');
     return true;