updated pmd.last_check handling to only allocate if needed

diff --git a/ChangeLog b/ChangeLog
index e9a9b77c86d613398bf1d4cb16303866f92fae27..64d12933097f2ba3790a07ec764ade228fa692f2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+88
+-- tweaked allocation of pmd.last_check
+
 87
 -- renamed api function typedefs to camel case for consistency and to match
    style guide

diff --git a/src/detection/detection_options.cc b/src/detection/detection_options.cc
index ede9675e61cf99e24b8c2a48cc68df47d6d0dce5..2ef329908648ea51d66414d5d4124a06cd4c7041 100644 (file)
--- a/src/detection/detection_options.cc
+++ b/src/detection/detection_options.cc
@@ -580,7 +580,7 @@ int detection_option_node_evaluate(
                      * option via the content option processing since only not
                      * contents that are not relative in any way will have this
                      * flag set */
-                    if (dup_content_option_data.exception_flag)
+                    if (dup_content_option_data.last_check)
                     {
                         PmdLastCheck* last_check =
                             dup_content_option_data.last_check + get_instance_id();

diff --git a/src/detection/fpdetect.cc b/src/detection/fpdetect.cc
index 0f4c3bf38ba59d68b3e9cf2514d399dd906d222e..e42699b6db0ba958f498f30d0d58e0ca7efdafce 100644 (file)
--- a/src/detection/fpdetect.cc
+++ b/src/detection/fpdetect.cc
@@ -506,12 +506,15 @@ static int rule_tree_match( void * id, void *tree, int index, void * data, void
         PMX *neg_pmx = (PMX *)ncl->pmx;
         PatternMatchData *neg_pmd = (PatternMatchData *)neg_pmx->PatternMatchData;
 
+        assert(neg_pmd->last_check);
+
         PmdLastCheck* last_check =
             neg_pmd->last_check + get_instance_id();
 
         last_check->ts.tv_sec = eval_data.p->pkth->ts.tv_sec;
         last_check->ts.tv_usec = eval_data.p->pkth->ts.tv_usec;
-        last_check->packet_number = (rule_eval_pkt_count + (PacketManager::get_rebuilt_packet_count()));
+        last_check->packet_number = (rule_eval_pkt_count
+            + (PacketManager::get_rebuilt_packet_count()));
         last_check->rebuild_flag = (eval_data.p->packet_flags & PKT_REBUILT_STREAM);
     }
 

diff --git a/src/ips_options/ips_content.cc b/src/ips_options/ips_content.cc
index 3a36d90016b24492617a4e70283df60370344e80..4ac446cc50ac8efb9555a507d0f78eea3f6b5f87 100644 (file)
--- a/src/ips_options/ips_content.cc
+++ b/src/ips_options/ips_content.cc
@@ -274,10 +274,9 @@ bool ContentOption::operator==(const IpsOption& ips) const
 // private helpers
 //-------------------------------------------------------------------------
 
-static PatternMatchData* NewNode()
+static PatternMatchData* new_pmd()
 {
     PatternMatchData *pmd = (PatternMatchData*)SnortAlloc(sizeof(PatternMatchData));
-    pmd->last_check = (PmdLastCheck*)SnortAlloc(get_instance_max() * sizeof(*pmd->last_check));
 
     /* Set any non-zero default values here. */
     pmd->offset_var = BYTE_EXTRACT_NO_VAR;
@@ -288,6 +287,12 @@ static PatternMatchData* NewNode()
     return pmd;
 }
 
+static void update_pmd(PatternMatchData* pmd)
+{
+    if ( pmd->exception_flag )
+        pmd->last_check = (PmdLastCheck*)SnortAlloc(get_instance_max() * sizeof(*pmd->last_check));
+}
+
 static int HasFastPattern(OptTreeNode *otn, int list_type)
 {
     OptFpList* fpl = otn ? otn->opt_func : nullptr;
@@ -565,6 +570,7 @@ bool is_unbounded(void* pv)
  * return  0 for not found
  * return -1 for error (search out of bounds)
  */
+// FIXIT PMD
 static int uniSearchReal(const char *data, int dlen, PatternMatchData *pmd, int nocase)
 {
     /*
@@ -988,6 +994,7 @@ int PatternMatchAdjustRelativeOffsets(
 
     return 1;
 }
+// FIXIT PMD
 
 //-------------------------------------------------------------------------
 // suboption handlers
@@ -1659,7 +1666,7 @@ static IpsOption* content_ctor(
     int opt_len = 0;
     char *next_opt;
 
-    pmd = NewNode();
+    pmd = new_pmd();
 
     if (!data)
         ParseError("No content pattern specified!");
@@ -1669,6 +1676,7 @@ static IpsOption* content_ctor(
 
     opt_data = PayloadExtractParameter(data_dup, &opt_len);
     content_parse(opt_data, pmd);
+    update_pmd(pmd);
     next_opt = opt_data + opt_len;
 
     pmd->http_buffer = HTTP_BUFFER_NONE;

diff --git a/src/ips_options/ips_content.h b/src/ips_options/ips_content.h
index 924e309c69762814b017d8ed135566062e070694..5d537fec8290d796087a12a2909da72fd57584e7 100644 (file)
--- a/src/ips_options/ips_content.h
+++ b/src/ips_options/ips_content.h
@@ -87,10 +87,11 @@ typedef struct _PatternMatchData
 
     int* replace_depth;      /* >=0 is offset to start of replace */
 
-    // FIXIT last_check REALLY shouldn't be in the PMD
+    // FIXIT wasting some memory here:
     // - this is not used by content option logic directly
     // - and only used on current eval (not across packets)
-    // so wasting a lot memory
+    // (partly mitigated by only allocating if excpetion_flag is set)
+    //
     /* Set if fast pattern matcher found a content in the packet,
        but the rule option specifies a negated content. Only
        applies to negative contents that are not relative */