diff --git a/src/detect-engine.c b/src/detect-engine.c index efd1b0f885..181b0023c8 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -2623,6 +2623,9 @@ void DetectEngineCtxFree(DetectEngineCtx *de_ctx) if (de_ctx->sig_array) SCFree(de_ctx->sig_array); + if (de_ctx->filedata_config) + SCFree(de_ctx->filedata_config); + DetectEngineFreeFastPatternList(de_ctx); SCClassConfDeInitContext(de_ctx); SCRConfDeInitContext(de_ctx); diff --git a/src/detect-file-data.c b/src/detect-file-data.c index 732dfd6373..a721c08c7c 100644 --- a/src/detect-file-data.c +++ b/src/detect-file-data.c @@ -94,11 +94,14 @@ void DetectFiledataRegister(void) } static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) { - if (de_ctx->filedata_config_initialized) + if (de_ctx->filedata_config) return; + de_ctx->filedata_config = SCMalloc(ALPROTO_MAX * sizeof(DetectFileDataCfg)); + if (unlikely(de_ctx->filedata_config == NULL)) + return; /* initialize default */ - for (int i = 0; i < (int)ALPROTO_MAX; i++) { + for (AppProto i = 0; i < ALPROTO_MAX; i++) { de_ctx->filedata_config[i].content_limit = FILEDATA_CONTENT_LIMIT; de_ctx->filedata_config[i].content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE; } @@ -109,8 +112,6 @@ static void SetupDetectEngineConfig(DetectEngineCtx *de_ctx) { de_ctx->filedata_config[ALPROTO_SMTP].content_limit = smtp_config.content_limit; de_ctx->filedata_config[ALPROTO_SMTP].content_inspect_min_size = smtp_config.content_inspect_min_size; - - de_ctx->filedata_config_initialized = true; } /** @@ -220,9 +221,12 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx, const uint64_t file_size = FileDataSize(cur_file); const DetectEngineCtx *de_ctx = det_ctx->de_ctx; - const uint32_t content_limit = de_ctx->filedata_config[f->alproto].content_limit; - const uint32_t content_inspect_min_size = - de_ctx->filedata_config[f->alproto].content_inspect_min_size; + uint32_t content_limit = FILEDATA_CONTENT_LIMIT; + uint32_t content_inspect_min_size = FILEDATA_CONTENT_INSPECT_MIN_SIZE; + if (de_ctx->filedata_config) { + content_limit = de_ctx->filedata_config[f->alproto].content_limit; + content_inspect_min_size = de_ctx->filedata_config[f->alproto].content_inspect_min_size; + } SCLogDebug("[list %d] content_limit %u, content_inspect_min_size %u", list_id, content_limit, content_inspect_min_size); diff --git a/src/detect.h b/src/detect.h index 397c4ae8aa..3715018c1a 100644 --- a/src/detect.h +++ b/src/detect.h @@ -832,6 +832,11 @@ enum DetectEngineType */ #define FLOW_STATES 2 +typedef struct { + uint32_t content_limit; + uint32_t content_inspect_min_size; +} DetectFileDataCfg; + /** \brief main detection engine ctx */ typedef struct DetectEngineCtx_ { bool failure_fatal; @@ -930,8 +935,6 @@ typedef struct DetectEngineCtx_ { /** The rule errored out due to missing requirements. */ bool sigerror_requires; - bool filedata_config_initialized; - /* specify the configuration for mpm context factory */ uint8_t sgh_mpm_ctx_cnf; @@ -939,10 +942,7 @@ typedef struct DetectEngineCtx_ { /** hash list of keywords that need thread local ctxs */ HashListTable *keyword_hash; - struct { - uint32_t content_limit; - uint32_t content_inspect_min_size; - } filedata_config[ALPROTO_MAX]; + DetectFileDataCfg *filedata_config; #ifdef PROFILE_RULES struct SCProfileDetectCtx_ *profile_ctx;