detect/file: use util to turn keyword to nocase

This changes the way the pattern is stored by making it lowercase.

(cherry picked from commit c5d83d081e9cd77e49d1477b26e276c979e29dab)

diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index f8e1bc6174844a1a32be2cff0c1ce5da1af03b59..2af09b48ef4b53aa2e57cd54110b9955e7150892 100644 (file)
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -236,13 +236,8 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_MAGIC, g_file_magic_buffer_id, s->alproto) < 0)
         return -1;

diff --git a/src/detect-filename.c b/src/detect-filename.c
index 2df4fd478a53195c435063f9f91ad46979af7541..6cd111ceffbd03e4b398af0837f0dc1b6e2a81a9 100644 (file)
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -201,14 +201,9 @@ static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
     cd->flags |= DETECT_CONTENT_ENDS_WITH;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0)
         return -1;
@@ -244,13 +239,8 @@ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const cha
         return -1;
 
     DetectContentData *cd = (DetectContentData *)sm->ctx;
-    cd->flags |= DETECT_CONTENT_NOCASE;
-    /* Recreate the context with nocase chars */
-    SpmDestroyCtx(cd->spm_ctx);
-    cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx);
-    if (cd->spm_ctx == NULL) {
+    if (DetectContentConvertToNocase(de_ctx, cd) != 0)
         return -1;
-    }
     if (DetectEngineContentModifierBufferSetup(
                 de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0)
         return -1;