From ab5070c0e3ca162238e563443b2d1f21f9fceb41 Mon Sep 17 00:00:00 2001
From: Eric Leblond <el@stamus-networks.com>
Date: Mon, 9 Jun 2025 11:10:20 +0200
Subject: [PATCH] detect/engine: put datajson related code in a func

---
 src/detect-engine-alert.c | 42 +++++++++++++++++++++++----------------
 1 file changed, 25 insertions(+), 17 deletions(-)

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index f062cdb14c..45f24329d4 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -284,31 +284,21 @@ static uint16_t AlertQueueExpand(DetectEngineThreadCtx *det_ctx)
     return new_cap;
 }
 
-/** \internal
- */
-static inline PacketAlert PacketAlertSet(
-        DetectEngineThreadCtx *det_ctx, const Signature *s, uint64_t tx_id, uint8_t alert_flags)
+static inline int PacketAlertSetContext(
+        DetectEngineThreadCtx *det_ctx, PacketAlert *pa, const Signature *s)
 {
-    PacketAlert pa;
-    pa.iid = s->iid;
-    pa.action = s->action;
-    pa.s = (Signature *)s;
-    pa.flags = alert_flags;
-    /* Set tx_id if the frame has it */
-    pa.tx_id = tx_id;
-    pa.frame_id = (alert_flags & PACKET_ALERT_FLAG_FRAME) ? det_ctx->frame_id : 0;
-    pa.json_info = NULL;
+    pa->json_info = NULL;
     if (det_ctx->json_content_len) {
         /* We have some JSON attached in the current detection so let's try
            to see if some need to be used for current signature. */
-        struct PacketContextData *current_json = pa.json_info;
+        struct PacketContextData *current_json = pa->json_info;
         if (current_json == NULL) {
             current_json = SCCalloc(1, sizeof(struct PacketContextData));
             if (current_json == NULL) {
                 /* Allocation error, let's return now */
-                return pa;
+                return -1;
             }
-            pa.json_info = current_json;
+            pa->json_info = current_json;
         }
         for (size_t i = 0; i < det_ctx->json_content_len; i++) {
             if (s == det_ctx->json_content[i].id) {
@@ -321,13 +311,31 @@ static inline PacketAlert PacketAlertSet(
                         current_json->next = NULL;
                     } else {
                         /* Allocation error, let's return now */
-                        return pa;
+                        return -1;
                     }
                 }
                 current_json->json_string = det_ctx->json_content[i].json_content;
             }
         }
     }
+
+    return 0;
+}
+
+/** \internal
+ */
+static inline PacketAlert PacketAlertSet(
+        DetectEngineThreadCtx *det_ctx, const Signature *s, uint64_t tx_id, uint8_t alert_flags)
+{
+    PacketAlert pa;
+    pa.iid = s->iid;
+    pa.action = s->action;
+    pa.s = (Signature *)s;
+    pa.flags = alert_flags;
+    /* Set tx_id if the frame has it */
+    pa.tx_id = tx_id;
+    pa.frame_id = (alert_flags & PACKET_ALERT_FLAG_FRAME) ? det_ctx->frame_id : 0;
+    PacketAlertSetContext(det_ctx, &pa, s);
     return pa;
 }