From be9e13c6b106ebc32da38effb18f6b71b19a1a45 Mon Sep 17 00:00:00 2001
From: Eric Leblond <el@stamus-networks.com>
Date: Mon, 9 Jun 2025 10:27:16 +0200
Subject: [PATCH] decode: use pointer for PacketContextData

By adding a pointer instead of the structure in the alert info
we spare some memory.
---
 src/decode.c              | 28 +++++++++++-----------------
 src/decode.h              |  2 +-
 src/detect-engine-alert.c | 13 ++++++++++---
 src/output-json-alert.c   |  4 ++--
 4 files changed, 24 insertions(+), 23 deletions(-)

diff --git a/src/decode.c b/src/decode.c
index ce8726d2a8..6167d45225 100644
--- a/src/decode.c
+++ b/src/decode.c
@@ -149,16 +149,13 @@ void PacketAlertRecycle(PacketAlert *pa_array)
 {
     if (pa_array != NULL) {
         for (int i = 0; i < packet_alert_max; i++) {
-            if (pa_array[i].json_info.next != NULL) {
-                struct PacketContextData *current_json = pa_array[i].json_info.next;
-                while (current_json) {
-                    struct PacketContextData *next_json = current_json->next;
-                    SCFree(current_json);
-                    current_json = next_json;
-                }
+            struct PacketContextData *current_json = pa_array[i].json_info;
+            while (current_json) {
+                struct PacketContextData *next_json = current_json->next;
+                SCFree(current_json);
+                current_json = next_json;
             }
-            pa_array[i].json_info.json_string = NULL;
-            pa_array[i].json_info.next = NULL;
+            pa_array[i].json_info = NULL;
         }
     }
 }
@@ -167,14 +164,11 @@ void PacketAlertFree(PacketAlert *pa)
 {
     if (pa != NULL) {
         for (int i = 0; i < packet_alert_max; i++) {
-            /* first item is not allocated so start at second one */
-            if (pa[i].json_info.next != NULL) {
-                struct PacketContextData *allocated_json = pa[i].json_info.next;
-                while (allocated_json) {
-                    struct PacketContextData *next_json = allocated_json->next;
-                    SCFree(allocated_json);
-                    allocated_json = next_json;
-                }
+            struct PacketContextData *allocated_json = pa[i].json_info;
+            while (allocated_json) {
+                struct PacketContextData *next_json = allocated_json->next;
+                SCFree(allocated_json);
+                allocated_json = next_json;
             }
         }
         SCFree(pa);
diff --git a/src/decode.h b/src/decode.h
index d5f8472e8b..9bb97a13f4 100644
--- a/src/decode.h
+++ b/src/decode.h
@@ -252,7 +252,7 @@ typedef struct PacketAlert_ {
     const struct Signature_ *s;
     uint64_t tx_id; /* Used for sorting */
     int64_t frame_id;
-    struct PacketContextData json_info;
+    struct PacketContextData *json_info;
 } PacketAlert;
 
 /**
diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 82bdcff59d..f062cdb14c 100644
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -297,12 +297,19 @@ static inline PacketAlert PacketAlertSet(
     /* Set tx_id if the frame has it */
     pa.tx_id = tx_id;
     pa.frame_id = (alert_flags & PACKET_ALERT_FLAG_FRAME) ? det_ctx->frame_id : 0;
-    pa.json_info.json_string = NULL;
-    pa.json_info.next = NULL;
+    pa.json_info = NULL;
     if (det_ctx->json_content_len) {
         /* We have some JSON attached in the current detection so let's try
            to see if some need to be used for current signature. */
-        struct PacketContextData *current_json = &pa.json_info;
+        struct PacketContextData *current_json = pa.json_info;
+        if (current_json == NULL) {
+            current_json = SCCalloc(1, sizeof(struct PacketContextData));
+            if (current_json == NULL) {
+                /* Allocation error, let's return now */
+                return pa;
+            }
+            pa.json_info = current_json;
+        }
         for (size_t i = 0; i < det_ctx->json_content_len; i++) {
             if (s == det_ctx->json_content[i].id) {
                 if (current_json->json_string != NULL) {
diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index a89c3b075c..9a8923cc5f 100644
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -253,9 +253,9 @@ void AlertJsonHeader(const Packet *p, const PacketAlert *pa, SCJsonBuilder *js,
         AlertJsonMetadata(pa, js);
     }
 
-    if (pa->json_info.json_string != NULL) {
+    if (pa->json_info != NULL) {
         SCJbOpenObject(js, "context");
-        const struct PacketContextData *json_info = &pa->json_info;
+        const struct PacketContextData *json_info = pa->json_info;
         while (json_info) {
             SCJbSetFormatted(js, json_info->json_string);
             json_info = json_info->next;