]> git.ipfire.org Git - thirdparty/suricata.git/commit
detect/isdataat: optimize recursion mismatches
authorVictor Julien <vjulien@oisf.net>
Mon, 25 Sep 2023 08:16:27 +0000 (10:16 +0200)
committerVictor Julien <victor@inliniac.net>
Thu, 7 Dec 2023 08:56:59 +0000 (09:56 +0100)
commit6db02563f1bf2e0e98852189f021e9db01f2305f
treeb5e4a31a92017aef26565157008ccf4b2150f43f
parentc19d11ff0d7841c58b00f541bd8c25d8585ae85d
detect/isdataat: optimize recursion mismatches

Since recursive content matching goes through the buffer from left to
right, it is possible to bail early when isdataat is part of the
recursive checking. If `isdataat:50,relative` fails for offset 10, it
will surely also fail for offset 20. So break inspection in such cases.

The exception is for dynamic isdataat, where the value is determined
by a prior byte_extract that may be updated during the recursion.
src/detect-engine-content-inspection.c
src/tests/detect-engine-content-inspection.c