http/multipart: optimize form end search

If we already know that the boundary exists, we can start looking
there. Otherwise, we can skip trying as the boundary is a subset
of the form end marker.

diff --git a/src/app-layer-htp.c b/src/app-layer-htp.c
index 22f3c16c395b22168a90a54bda1026e94df7d881..4fe65e117c5b12dc0c6349743707d572dcd49583 100644 (file)
--- a/src/app-layer-htp.c
+++ b/src/app-layer-htp.c
@@ -1313,15 +1313,16 @@ static int HtpRequestBodyHandleMultipart(HtpState *hstate, HtpTxUserData *htud,
     /* search for the header start, header end and form end */
     const uint8_t *header_start = Bs2bmSearch(chunks_buffer, chunks_buffer_len,
             boundary, expected_boundary_len);
+    /* end of the multipart form */
+    uint8_t *form_end = NULL;
     /* end marker belonging to header_start */
     uint8_t *header_end = NULL;
     if (header_start != NULL) {
         header_end = Bs2bmSearch(header_start, chunks_buffer_len - (header_start - chunks_buffer),
                 (uint8_t *)"\r\n\r\n", 4);
+        form_end = Bs2bmSearch(header_start, chunks_buffer_len - (header_start - chunks_buffer),
+                boundary, expected_boundary_end_len);
     }
-    /* end of the multipart form */
-    const uint8_t *form_end = Bs2bmSearch(chunks_buffer, chunks_buffer_len,
-            boundary, expected_boundary_end_len);
 
     SCLogDebug("header_start %p, header_end %p, form_end %p", header_start,
             header_end, form_end);