quic: do not use stack for inspection buffer

Make the inspection buffer copy the content in one buffer it owns.

Ticket: #5707

diff --git a/src/util-ja3.c b/src/util-ja3.c
index 270e3e42d81c7a49539aa5d71af84516d3e01641..78a49a61bddbfd6ae9264a1f49ce89825c114a73 100644 (file)
--- a/src/util-ja3.c
+++ b/src/util-ja3.c
@@ -277,7 +277,8 @@ InspectionBuffer *Ja3DetectGetHash(DetectEngineThreadCtx *det_ctx,
         // this adds a final zero
         SCMd5HashBufferToHex(b, b_len, (char *)ja3_hash, SC_MD5_HEX_LEN + 1);
 
-        InspectionBufferSetup(det_ctx, list_id, buffer, ja3_hash, SC_MD5_HEX_LEN);
+        InspectionBufferSetup(det_ctx, list_id, buffer, NULL, 0);
+        InspectionBufferCopy(buffer, ja3_hash, SC_MD5_HEX_LEN);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;