detect/frames: minor cleanup in buffer handling

Don't lookup a buffer twice, even if the lookup should be fast.

diff --git a/src/detect-engine-frame.c b/src/detect-engine-frame.c
index 2eaae4267aa3f746a920d15afbd8368cd02be969..d9408fe49253dae90055f8a10814d824169e5871 100644 (file)
--- a/src/detect-engine-frame.c
+++ b/src/detect-engine-frame.c
@@ -202,6 +202,8 @@ struct FrameStreamData {
     uint32_t idx;
     uint64_t frame_data_offset_abs;
     uint64_t frame_start_offset_abs;
+    /** buffer is set if callback was successful */
+    InspectionBuffer *buffer;
 };
 
 static int FrameStreamDataFunc(
@@ -271,6 +273,7 @@ static int FrameStreamDataFunc(
     InspectionBufferSetupMulti(buffer, fsd->transforms, data, data_len);
     buffer->inspect_offset = frame->rel_offset < 0 ? -1 * frame->rel_offset : 0; // TODO review/test
     buffer->flags = ci_flags;
+    fsd->buffer = buffer;
     return 1; // for now only the first chunk
 }
 
@@ -343,13 +346,10 @@ InspectionBuffer *DetectFrame2InspectBuffer(DetectEngineThreadCtx *det_ctx,
         return NULL;
 
     struct FrameStreamData fsd = { det_ctx, transforms, frame, list_id, idx, offset,
-        (uint64_t)frame_start_abs_offset };
+        (uint64_t)frame_start_abs_offset, NULL };
     StreamReassembleForFrame(ssn, stream, FrameStreamDataFunc, &fsd, offset, eof);
     SCLogDebug("offset %" PRIu64, offset);
-
-    InspectionBuffer *ret = InspectionBufferMultipleForListGet(det_ctx, list_id, idx);
-    SCLogDebug("ret %p", ret);
-    return ret;
+    return fsd.buffer;
 }
 
 /**