detect/buffer: add initialized flag to simplify buffer logic

diff --git a/src/detect-engine.c b/src/detect-engine.c
index bb56c81c724cc197a0ef1fdde364f45dcd9fd3ba..d47f4afc9e66e70966ec35d5e8131f72dd389769 100644 (file)
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -1341,6 +1341,7 @@ void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
         const uint32_t idx = det_ctx->inspect.to_clear_queue[i];
         InspectionBuffer *buffer = &det_ctx->inspect.buffers[idx];
         buffer->inspect = NULL;
+        buffer->initialized = false;
     }
     det_ctx->inspect.to_clear_idx = 0;
 
@@ -1352,6 +1353,7 @@ void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
         for (uint32_t x = 0; x <= mbuffer->max; x++) {
             InspectionBuffer *buffer = &mbuffer->inspection_buffers[x];
             buffer->inspect = NULL;
+            buffer->initialized = false;
         }
         mbuffer->init = 0;
         mbuffer->max = 0;
@@ -1435,6 +1437,7 @@ void InspectionBufferSetupMulti(InspectionBuffer *buffer, const DetectEngineTran
     buffer->inspect = buffer->orig = data;
     buffer->inspect_len = buffer->orig_len = data_len;
     buffer->len = 0;
+    buffer->initialized = true;
 
     InspectionBufferApplyTransforms(buffer, transforms);
 }
@@ -1456,6 +1459,7 @@ void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
     buffer->inspect = buffer->orig = data;
     buffer->inspect_len = buffer->orig_len = data_len;
     buffer->len = 0;
+    buffer->initialized = true;
 }
 
 void InspectionBufferFree(InspectionBuffer *buffer)
@@ -1496,6 +1500,7 @@ void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_l
         memcpy(buffer->buf, buf, copy_size);
         buffer->inspect = buffer->buf;
         buffer->inspect_len = copy_size;
+        buffer->initialized = true;
     }
 }
 

diff --git a/src/detect.h b/src/detect.h
index 234163500a4d1a4fd52f98dc6e32e6bc06cb1a13..e91ab2c46dd50f1cc160334217b63c8aa33d2d26 100644 (file)
--- a/src/detect.h
+++ b/src/detect.h
@@ -338,6 +338,7 @@ typedef struct InspectionBuffer {
     const uint8_t *inspect; /**< active pointer, points either to ::buf or ::orig */
     uint64_t inspect_offset;
     uint32_t inspect_len;   /**< size of active data. See to ::len or ::orig_len */
+    bool initialized; /**< is initialized. ::inspect might be NULL if transform lead to 0 size */
     uint8_t flags;          /**< DETECT_CI_FLAGS_* for use with DetectEngineContentInspection */
 #ifdef DEBUG_VALIDATION
     bool multi;