Merge pull request #2348 in SNORT/snort3 from ~THOPETER/snort3:nhttp144 to master

Squashed commit of the following:

commit 589b55a368214f4286f435e8d9d92ce2889624f4
Author: Tom Peters <thopeter@cisco.com>
Date:   Fri Jul 24 17:59:43 2020 -0400

    http_inspect: reduce memory used by partial inspections

diff --git a/src/service_inspectors/http_inspect/http_inspect.cc b/src/service_inspectors/http_inspect/http_inspect.cc
index 73c532c05b8c4710c172385325d436ffcfc6dbf7..e3f800b693064f29e8ffed4aba72aea44b3f574e 100644 (file)
--- a/src/service_inspectors/http_inspect/http_inspect.cc
+++ b/src/service_inspectors/http_inspect/http_inspect.cc
@@ -445,8 +445,7 @@ void HttpInspect::eval(Packet* p)
         p->set_detect_limit(session_data->detect_depth_remaining[source_id]);
     }
 
-    const bool buf_owner = !session_data->partial_flush[source_id];
-    if (!process(p->data, p->dsize, p->flow, source_id, buf_owner))
+    if (!process(p->data, p->dsize, p->flow, source_id, true))
         disable_detection(p);
 
 #ifdef REG_TEST

diff --git a/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc b/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc
index 49be2d494e5ec43ad584039e354dd06f4628ad62..2dd2732c59cc5c0b81be4e5288018c869c24793f 100644 (file)
--- a/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc
+++ b/src/service_inspectors/http_inspect/http_stream_splitter_reassemble.cc
@@ -416,7 +416,8 @@ const StreamBuffer HttpStreamSplitter::reassemble(Flow* flow, unsigned total,
         if (session_data->partial_flush[source_id])
         {
             // Store the data from a partial flush for reuse
-            partial_buffer = buffer;
+            partial_buffer = new uint8_t[buf_size];
+            memcpy(partial_buffer, buffer, buf_size);
             partial_buffer_length = buf_size;
             partial_raw_bytes += total;
         }