detect/engine: helper to know if a transform happens in-place

rust/sys/src/sys.rs

@@ -720,6 +720,9 @@ extern "C" {
         det_ctx: *mut DetectEngineThreadCtx, list_id: ::std::os::raw::c_int,
     ) -> *mut InspectionBuffer;
 }
+extern "C" {
+    pub fn SCInspectionBufferInPlace(buffer: *const InspectionBuffer) -> bool;
+}
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
 pub struct SigMatchCtx_ {

src/detect-engine-inspect-buffer.c

@@ -255,3 +255,10 @@ void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_l
         buffer->initialized = true;
     }
 }
+
+// Returns wether the inspection buffer will make the transform run in-place
+// Especially useful for transforms that produces an output longer than the input
+bool SCInspectionBufferInPlace(const InspectionBuffer *buffer)
+{
+    return buffer->inspect == buffer->buf;
+}

src/detect-engine-inspect-buffer.h

@@ -72,5 +72,6 @@ void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer
         const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len);
 InspectionBuffer *InspectionBufferMultipleForListGet(
         DetectEngineThreadCtx *det_ctx, const int list_id, uint32_t local_id);
+bool SCInspectionBufferInPlace(const InspectionBuffer *buffer);
 
 #endif /* SURICATA_DETECT_ENGINE_INSPECT_BUFFER_H */