detect/content-inspect: use of replace keyword is rare

Hint compiler about this.

diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c
index 81f2e30f31a6b942e30c6123d6a57f12c7326978..b204d1edaa7e9c5506406850b722a95ac0855c68 100644 (file)
--- a/src/detect-engine-content-inspection.c
+++ b/src/detect-engine-content-inspection.c
@@ -337,7 +337,7 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx,
 
             if ((cd->flags & DETECT_CONTENT_ENDS_WITH) == 0 || match_offset == buffer_len) {
                 /* Match branch, add replace to the list if needed */
-                if (cd->flags & DETECT_CONTENT_REPLACE) {
+                if (unlikely(cd->flags & DETECT_CONTENT_REPLACE)) {
                     if (inspection_mode == DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD) {
                         /* we will need to replace content if match is confirmed
                          * cast to non-const as replace writes to it. */