From: Victor Julien <victor@inliniac.net>
Date: Thu, 4 Feb 2021 13:48:11 +0000 (+0100)
Subject: detect: fix heap overflow issue with buffer setup
X-Git-Tag: suricata-7.0.0-beta1~1824
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=13cebb1857c3637f55a566ed694e7ed7f0ee0d87;p=thirdparty%2Fsuricata.git

detect: fix heap overflow issue with buffer setup

In some cases, the InspectionBufferGet function would be followed by
a failure to set the buffer up, for example due to a HTTP body limit
not yet being reached. Yet each call to InspectionBufferGet would lead
to the matching list_id to be added to the
DetectEngineThreadCtx::inspect.to_clear_queue. This array is sized to
add each list only once, but in this case the same id could be added
multiple times, potentially overflowing the array.
---

diff --git a/src/detect-dce-stub-data.c b/src/detect-dce-stub-data.c
index 416109fe0f..69a9f1a849 100644
--- a/src/detect-dce-stub-data.c
+++ b/src/detect-dce-stub-data.c
@@ -79,7 +79,7 @@ static InspectionBuffer *GetSMBData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         SCLogDebug("have data!");
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
@@ -105,7 +105,7 @@ static InspectionBuffer *GetDCEData(DetectEngineThreadCtx *det_ctx,
         } else {
             buffer->flags |= DETECT_CI_FLAGS_DCE_BE;
         }
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-dnp3.c b/src/detect-dnp3.c
index d0f78e7ac7..232dd28cdd 100644
--- a/src/detect-dnp3.c
+++ b/src/detect-dnp3.c
@@ -170,7 +170,7 @@ static InspectionBuffer *GetDNP3Data(DetectEngineThreadCtx *det_ctx,
             return NULL;
 
         SCLogDebug("tx %p data %p data_len %u", tx, data, data_len);
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-dns-query.c b/src/detect-dns-query.c
index 5e4b5f1051..a029f8bac2 100644
--- a/src/detect-dns-query.c
+++ b/src/detect-dns-query.c
@@ -91,7 +91,7 @@ static InspectionBuffer *DnsQueryGetData(DetectEngineThreadCtx *det_ctx,
                 &data, &data_len) == 0) {
         return NULL;
     }
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-engine.c b/src/detect-engine.c
index cbb681963b..83f80913cd 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -996,11 +996,7 @@ void InspectionBufferClean(DetectEngineThreadCtx *det_ctx)
 
 InspectionBuffer *InspectionBufferGet(DetectEngineThreadCtx *det_ctx, const int list_id)
 {
-    InspectionBuffer *buffer = &det_ctx->inspect.buffers[list_id];
-    if (buffer->inspect == NULL) {
-        det_ctx->inspect.to_clear_queue[det_ctx->inspect.to_clear_idx++] = list_id;
-    }
-    return buffer;
+    return &det_ctx->inspect.buffers[list_id];
 }
 
 /** \brief for a InspectionBufferMultipleForList get a InspectionBuffer
@@ -1053,8 +1049,15 @@ void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size)
 }
 
 /** \brief setup the buffer with our initial data */
-void InspectionBufferSetup(InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
+void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
+        InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len)
 {
+    if (buffer->inspect == NULL) {
+#ifdef UNITTESTS
+        if (det_ctx && list_id != -1)
+#endif
+            det_ctx->inspect.to_clear_queue[det_ctx->inspect.to_clear_idx++] = list_id;
+    }
     buffer->inspect = buffer->orig = data;
     buffer->inspect_len = buffer->orig_len = data_len;
     buffer->len = 0;
diff --git a/src/detect-engine.h b/src/detect-engine.h
index dc72b2f670..8f6ef4aaea 100644
--- a/src/detect-engine.h
+++ b/src/detect-engine.h
@@ -29,7 +29,8 @@
 #include "flow-private.h"
 
 void InspectionBufferInit(InspectionBuffer *buffer, uint32_t initial_size);
-void InspectionBufferSetup(InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len);
+void InspectionBufferSetup(DetectEngineThreadCtx *det_ctx, const int list_id,
+        InspectionBuffer *buffer, const uint8_t *data, const uint32_t data_len);
 void InspectionBufferFree(InspectionBuffer *buffer);
 void InspectionBufferCheckAndExpand(InspectionBuffer *buffer, uint32_t min_size);
 void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_len);
diff --git a/src/detect-file-data.c b/src/detect-file-data.c
index cc39cb9181..78e6bcb9f4 100644
--- a/src/detect-file-data.c
+++ b/src/detect-file-data.c
@@ -405,7 +405,7 @@ static InspectionBuffer *HttpServerBodyGetDataCallback(DetectEngineThreadCtx *de
 
     StreamingBufferGetDataAtOffset(body->sb,
             &data, &data_len, offset);
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     buffer->inspect_offset = offset;
 
     /* built-in 'transformation' */
@@ -483,7 +483,7 @@ static InspectionBuffer *FiledataGetDataCallback(DetectEngineThreadCtx *det_ctx,
     StreamingBufferGetDataAtOffset(cur_file->sb,
             &data, &data_len,
             cur_file->content_inspected);
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     SCLogDebug("[list %d] [before] buffer offset %" PRIu64 "; buffer len %" PRIu32
                "; data_len %" PRIu32 "; file_size %" PRIu64,
             list_id, buffer->inspect_offset, buffer->inspect_len, data_len, file_size);
diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c
index 536e88803f..2f3c23a3b4 100644
--- a/src/detect-filemagic.c
+++ b/src/detect-filemagic.c
@@ -461,7 +461,7 @@ static InspectionBuffer *FilemagicGetDataCallback(DetectEngineThreadCtx *det_ctx
     const uint8_t *data = (const uint8_t *)cur_file->magic;
     uint32_t data_len = (uint32_t)strlen(cur_file->magic);
 
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-filename.c b/src/detect-filename.c
index 2c82fede9a..301f51ea94 100644
--- a/src/detect-filename.c
+++ b/src/detect-filename.c
@@ -367,7 +367,7 @@ static InspectionBuffer *FilenameGetDataCallback(DetectEngineThreadCtx *det_ctx,
     const uint8_t *data = cur_file->name;
     uint32_t data_len = cur_file->name_len;
 
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-http-client-body.c b/src/detect-http-client-body.c
index 97d2927829..cacc3ed6a9 100644
--- a/src/detect-http-client-body.c
+++ b/src/detect-http-client-body.c
@@ -257,7 +257,7 @@ static InspectionBuffer *HttpClientBodyGetDataCallback(DetectEngineThreadCtx *de
 
     StreamingBufferGetDataAtOffset(body->sb,
             &data, &data_len, offset);
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     InspectionBufferApplyTransforms(buffer, transforms);
     buffer->inspect_offset = offset;
 
diff --git a/src/detect-http-cookie.c b/src/detect-http-cookie.c
index 74fc9f98a4..a1068da0f0 100644
--- a/src/detect-http-cookie.c
+++ b/src/detect-http-cookie.c
@@ -182,7 +182,7 @@ static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(h->value);
         const uint8_t *data = bstr_ptr(h->value);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
@@ -210,7 +210,7 @@ static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(h->value);
         const uint8_t *data = bstr_ptr(h->value);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-header-names.c b/src/detect-http-header-names.c
index dde59f9597..989a24c3e5 100644
--- a/src/detect-http-header-names.c
+++ b/src/detect-http-header-names.c
@@ -189,7 +189,7 @@ static void PrefilterTxHttpRequestHeaderNames(DetectEngineThreadCtx *det_ctx,
             return;
 
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, ctx->transforms);
     }
 
@@ -267,7 +267,7 @@ static void PrefilterTxHttpResponseHeaderNames(DetectEngineThreadCtx *det_ctx,
             return;
 
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, ctx->transforms);
     }
 
@@ -332,7 +332,7 @@ static int InspectEngineHttpHeaderNames(
             goto end;
         }
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-header.c b/src/detect-http-header.c
index e2b1904ede..8eabfebecf 100644
--- a/src/detect-http-header.c
+++ b/src/detect-http-header.c
@@ -176,7 +176,7 @@ static int DetectEngineInspectBufferHttpHeader(
             goto end;
         }
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
@@ -243,7 +243,7 @@ static void PrefilterMpmHttpHeader(DetectEngineThreadCtx *det_ctx,
             return;
 
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, ctx->transforms);
     }
 
diff --git a/src/detect-http-headers-stub.h b/src/detect-http-headers-stub.h
index 07e18e7aae..33fea36533 100644
--- a/src/detect-http-headers-stub.h
+++ b/src/detect-http-headers-stub.h
@@ -74,7 +74,7 @@ static InspectionBuffer *GetRequestData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(h->value);
         const uint8_t *data = bstr_ptr(h->value);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
@@ -107,7 +107,7 @@ static InspectionBuffer *GetResponseData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(h->value);
         const uint8_t *data = bstr_ptr(h->value);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-host.c b/src/detect-http-host.c
index fdf47641fe..0870fd920f 100644
--- a/src/detect-http-host.c
+++ b/src/detect-http-host.c
@@ -233,7 +233,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->request_hostname);
         const uint8_t *data = bstr_ptr(tx->request_hostname);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
@@ -306,7 +306,7 @@ static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
             data_len = bstr_len(tx->parsed_uri->hostname);
         }
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-method.c b/src/detect-http-method.c
index 9d185cedc0..4674ea6467 100644
--- a/src/detect-http-method.c
+++ b/src/detect-http-method.c
@@ -201,7 +201,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->request_method);
         const uint8_t *data = bstr_ptr(tx->request_method);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-protocol.c b/src/detect-http-protocol.c
index 1cae37e2d7..6a35ac7e9b 100644
--- a/src/detect-http-protocol.c
+++ b/src/detect-http-protocol.c
@@ -109,7 +109,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-raw-header.c b/src/detect-http-raw-header.c
index 57d1b648f2..e75dbb96ee 100644
--- a/src/detect-http-raw-header.c
+++ b/src/detect-http-raw-header.c
@@ -189,7 +189,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = ts ?
             tx_ud->request_headers_raw_len : tx_ud->response_headers_raw_len;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-request-line.c b/src/detect-http-request-line.c
index 963ca3d08f..8f6ae56267 100644
--- a/src/detect-http-request-line.c
+++ b/src/detect-http-request-line.c
@@ -139,7 +139,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->request_line);
         const uint8_t *data = bstr_ptr(tx->request_line);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-http-response-line.c b/src/detect-http-response-line.c
index 42d7c9a283..64d915c675 100644
--- a/src/detect-http-response-line.c
+++ b/src/detect-http-response-line.c
@@ -138,7 +138,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->response_line);
         const uint8_t *data = bstr_ptr(tx->response_line);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-http-start.c b/src/detect-http-start.c
index 4e6decc03f..1a42e088b1 100644
--- a/src/detect-http-start.c
+++ b/src/detect-http-start.c
@@ -190,7 +190,7 @@ static void PrefilterTxHttpRequestStart(DetectEngineThreadCtx *det_ctx,
             return;
 
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, ctx->transforms);
     }
 
@@ -264,7 +264,7 @@ static void PrefilterTxHttpResponseStart(DetectEngineThreadCtx *det_ctx,
             return;
 
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, ctx->transforms);
     }
 
@@ -329,7 +329,7 @@ static int InspectEngineHttpStart(
             goto end;
         }
         /* setup buffer and apply transforms */
-        InspectionBufferSetup(buffer, rawdata, rawdata_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, rawdata, rawdata_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-stat-code.c b/src/detect-http-stat-code.c
index 22433a6b8e..bd0405508e 100644
--- a/src/detect-http-stat-code.c
+++ b/src/detect-http-stat-code.c
@@ -163,7 +163,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->response_status);
         const uint8_t *data = bstr_ptr(tx->response_status);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-stat-msg.c b/src/detect-http-stat-msg.c
index c59f9c2671..6eeb5685cc 100644
--- a/src/detect-http-stat-msg.c
+++ b/src/detect-http-stat-msg.c
@@ -163,7 +163,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->response_message);
         const uint8_t *data = bstr_ptr(tx->response_message);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-ua.c b/src/detect-http-ua.c
index a4d9f39ccf..f7be34d055 100644
--- a/src/detect-http-ua.c
+++ b/src/detect-http-ua.c
@@ -169,7 +169,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(h->value);
         const uint8_t *data = bstr_ptr(h->value);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http-uri.c b/src/detect-http-uri.c
index dafbae7233..a05c203e83 100644
--- a/src/detect-http-uri.c
+++ b/src/detect-http-uri.c
@@ -228,7 +228,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx_ud->request_uri_normalized);
         const uint8_t *data = bstr_ptr(tx_ud->request_uri_normalized);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
@@ -298,7 +298,7 @@ static InspectionBuffer *GetRawData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = bstr_len(tx->request_uri);
         const uint8_t *data = bstr_ptr(tx->request_uri);
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-http2.c b/src/detect-http2.c
index af51cd1eb0..4e89214d67 100644
--- a/src/detect-http2.c
+++ b/src/detect-http2.c
@@ -706,7 +706,7 @@ static InspectionBuffer *GetHttp2HNameData(DetectEngineThreadCtx *det_ctx,
     if (b == NULL || b_len == 0)
         return NULL;
 
-    InspectionBufferSetup(buffer, b, b_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
@@ -840,7 +840,7 @@ static InspectionBuffer *GetHttp2HeaderData(DetectEngineThreadCtx *det_ctx,
     if (b == NULL || b_len == 0)
         return NULL;
 
-    InspectionBufferSetup(buffer, b, b_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-icmpv4hdr.c b/src/detect-icmpv4hdr.c
index 6e626c45b3..42a6b49222 100644
--- a/src/detect-icmpv4hdr.c
+++ b/src/detect-icmpv4hdr.c
@@ -112,7 +112,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = hlen;
         const uint8_t *data = (const uint8_t *)p->icmpv4h;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-icmpv6hdr.c b/src/detect-icmpv6hdr.c
index ffe9595aa9..f892f5921b 100644
--- a/src/detect-icmpv6hdr.c
+++ b/src/detect-icmpv6hdr.c
@@ -118,7 +118,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = hlen;
         const uint8_t *data = (const uint8_t *)p->icmpv6h;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ipv4hdr.c b/src/detect-ipv4hdr.c
index 87b29c5aef..e39dddea05 100644
--- a/src/detect-ipv4hdr.c
+++ b/src/detect-ipv4hdr.c
@@ -117,7 +117,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = hlen;
         const uint8_t *data = (const uint8_t *)p->ip4h;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ipv6hdr.c b/src/detect-ipv6hdr.c
index e559223420..e7221a9f9e 100644
--- a/src/detect-ipv6hdr.c
+++ b/src/detect-ipv6hdr.c
@@ -118,7 +118,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = hlen;
         const uint8_t *data = (const uint8_t *)p->ip6h;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-krb5-cname.c b/src/detect-krb5-cname.c
index 251baa0d01..e7ca0fe84a 100644
--- a/src/detect-krb5-cname.c
+++ b/src/detect-krb5-cname.c
@@ -76,7 +76,7 @@ static InspectionBuffer *GetKrb5CNameData(DetectEngineThreadCtx *det_ctx,
     if (b == NULL || b_len == 0)
         return NULL;
 
-    InspectionBufferSetup(buffer, b, b_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-krb5-sname.c b/src/detect-krb5-sname.c
index e4d8634600..fd33bb49bf 100644
--- a/src/detect-krb5-sname.c
+++ b/src/detect-krb5-sname.c
@@ -76,7 +76,7 @@ static InspectionBuffer *GetKrb5SNameData(DetectEngineThreadCtx *det_ctx,
     if (b == NULL || b_len == 0)
         return NULL;
 
-    InspectionBufferSetup(buffer, b, b_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-mqtt-connect-clientid.c b/src/detect-mqtt-connect-clientid.c
index 2fca0c4c88..421b486d1e 100644
--- a/src/detect-mqtt-connect-clientid.c
+++ b/src/detect-mqtt-connect-clientid.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-connect-password.c b/src/detect-mqtt-connect-password.c
index 506b874e58..9c964418cd 100644
--- a/src/detect-mqtt-connect-password.c
+++ b/src/detect-mqtt-connect-password.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-connect-username.c b/src/detect-mqtt-connect-username.c
index 57e4a2f631..a4f5a723d5 100644
--- a/src/detect-mqtt-connect-username.c
+++ b/src/detect-mqtt-connect-username.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-connect-willmessage.c b/src/detect-mqtt-connect-willmessage.c
index 4d82e68d25..4fdcab6250 100644
--- a/src/detect-mqtt-connect-willmessage.c
+++ b/src/detect-mqtt-connect-willmessage.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-connect-willtopic.c b/src/detect-mqtt-connect-willtopic.c
index 3bc9db6301..2794a7d48c 100644
--- a/src/detect-mqtt-connect-willtopic.c
+++ b/src/detect-mqtt-connect-willtopic.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-publish-message.c b/src/detect-mqtt-publish-message.c
index ba43aa9956..32671bc32c 100644
--- a/src/detect-mqtt-publish-message.c
+++ b/src/detect-mqtt-publish-message.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-publish-topic.c b/src/detect-mqtt-publish-topic.c
index d7fb7ba22e..3a33acf732 100644
--- a/src/detect-mqtt-publish-topic.c
+++ b/src/detect-mqtt-publish-topic.c
@@ -63,7 +63,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-mqtt-subscribe-topic.c b/src/detect-mqtt-subscribe-topic.c
index 30b4e48326..57ab2c4c03 100644
--- a/src/detect-mqtt-subscribe-topic.c
+++ b/src/detect-mqtt-subscribe-topic.c
@@ -83,7 +83,7 @@ static InspectionBuffer *MQTTSubscribeTopicGetData(DetectEngineThreadCtx *det_ct
         return NULL;
     }
 
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-mqtt-unsubscribe-topic.c b/src/detect-mqtt-unsubscribe-topic.c
index 3eb7490e01..307f843ea4 100644
--- a/src/detect-mqtt-unsubscribe-topic.c
+++ b/src/detect-mqtt-unsubscribe-topic.c
@@ -83,7 +83,7 @@ static InspectionBuffer *MQTTUnsubscribeTopicGetData(DetectEngineThreadCtx *det_
         return NULL;
     }
 
-    InspectionBufferSetup(buffer, data, data_len);
+    InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-rfb-name.c b/src/detect-rfb-name.c
index d46819fd32..556c3e0c68 100644
--- a/src/detect-rfb-name.c
+++ b/src/detect-rfb-name.c
@@ -82,7 +82,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-sip-method.c b/src/detect-sip-method.c
index 477f961387..05417755c6 100644
--- a/src/detect-sip-method.c
+++ b/src/detect-sip-method.c
@@ -115,7 +115,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-sip-protocol.c b/src/detect-sip-protocol.c
index e8e4de72f0..ed8e780fbd 100644
--- a/src/detect-sip-protocol.c
+++ b/src/detect-sip-protocol.c
@@ -85,7 +85,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         if (b == NULL || b_len == 0)
             return NULL;
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-sip-request-line.c b/src/detect-sip-request-line.c
index 9341f2b604..2e91a01b50 100644
--- a/src/detect-sip-request-line.c
+++ b/src/detect-sip-request-line.c
@@ -86,7 +86,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-sip-response-line.c b/src/detect-sip-response-line.c
index a6aaeb3795..879d5bc693 100644
--- a/src/detect-sip-response-line.c
+++ b/src/detect-sip-response-line.c
@@ -86,7 +86,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-sip-stat-code.c b/src/detect-sip-stat-code.c
index b98e520217..8c15b050ea 100644
--- a/src/detect-sip-stat-code.c
+++ b/src/detect-sip-stat-code.c
@@ -88,7 +88,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-sip-stat-msg.c b/src/detect-sip-stat-msg.c
index c29851b9e0..f8aac9a5c4 100644
--- a/src/detect-sip-stat-msg.c
+++ b/src/detect-sip-stat-msg.c
@@ -88,7 +88,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-sip-uri.c b/src/detect-sip-uri.c
index 074e8e43e8..53d3ed954c 100644
--- a/src/detect-sip-uri.c
+++ b/src/detect-sip-uri.c
@@ -98,7 +98,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-smb-share.c b/src/detect-smb-share.c
index f770929d45..c54ffa3779 100644
--- a/src/detect-smb-share.c
+++ b/src/detect-smb-share.c
@@ -69,7 +69,7 @@ static InspectionBuffer *GetNamedPipeData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
@@ -132,7 +132,7 @@ static InspectionBuffer *GetShareData(DetectEngineThreadCtx *det_ctx,
         if (b == NULL || b_len == 0)
             return NULL;
 
-        InspectionBufferSetup(buffer, b, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, b, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;
diff --git a/src/detect-snmp-community.c b/src/detect-snmp-community.c
index 6769d7d4b4..f1882c269e 100644
--- a/src/detect-snmp-community.c
+++ b/src/detect-snmp-community.c
@@ -104,7 +104,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ssh-hassh-server-string.c b/src/detect-ssh-hassh-server-string.c
index 6c6b0b10ee..d6a76f5f12 100644
--- a/src/detect-ssh-hassh-server-string.c
+++ b/src/detect-ssh-hassh-server-string.c
@@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, hassh, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ssh-hassh-server.c b/src/detect-ssh-hassh-server.c
index 3978dc3a0f..3f703c051b 100644
--- a/src/detect-ssh-hassh-server.c
+++ b/src/detect-ssh-hassh-server.c
@@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, hasshServer, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, hasshServer, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ssh-hassh-string.c b/src/detect-ssh-hassh-string.c
index 5c34371693..a6ad4223b4 100644
--- a/src/detect-ssh-hassh-string.c
+++ b/src/detect-ssh-hassh-string.c
@@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, hassh, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ssh-hassh.c b/src/detect-ssh-hassh.c
index 8cd4b5749d..dbc0dd832f 100644
--- a/src/detect-ssh-hassh.c
+++ b/src/detect-ssh-hassh.c
@@ -77,7 +77,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, hassh, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, hassh, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ssh-proto.c b/src/detect-ssh-proto.c
index d8eec71d4e..4f4874a916 100644
--- a/src/detect-ssh-proto.c
+++ b/src/detect-ssh-proto.c
@@ -74,7 +74,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, protocol, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, protocol, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-ssh-software.c b/src/detect-ssh-software.c
index 9765e3844e..ac7b1973ce 100644
--- a/src/detect-ssh-software.c
+++ b/src/detect-ssh-software.c
@@ -74,7 +74,7 @@ static InspectionBuffer *GetSshData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        InspectionBufferSetup(buffer, software, b_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, software, b_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tcphdr.c b/src/detect-tcphdr.c
index 3b0cde3f31..4b6a65986d 100644
--- a/src/detect-tcphdr.c
+++ b/src/detect-tcphdr.c
@@ -119,7 +119,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = hlen;
         const uint8_t *data = (const uint8_t *)p->tcph;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-template-buffer.c b/src/detect-template-buffer.c
index 6264f81b58..e988255b9e 100644
--- a/src/detect-template-buffer.c
+++ b/src/detect-template-buffer.c
@@ -133,7 +133,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
             return NULL; /* no buffer */
         }
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-cert-fingerprint.c b/src/detect-tls-cert-fingerprint.c
index 7bb827bc75..130daadf3c 100644
--- a/src/detect-tls-cert-fingerprint.c
+++ b/src/detect-tls-cert-fingerprint.c
@@ -141,7 +141,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->server_connp.cert0_fingerprint);
         const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_fingerprint;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-cert-issuer.c b/src/detect-tls-cert-issuer.c
index 18591661dd..bf89e6550a 100644
--- a/src/detect-tls-cert-issuer.c
+++ b/src/detect-tls-cert-issuer.c
@@ -131,7 +131,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->server_connp.cert0_issuerdn);
         const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_issuerdn;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-cert-serial.c b/src/detect-tls-cert-serial.c
index ce0950b321..4d5bfdbf82 100644
--- a/src/detect-tls-cert-serial.c
+++ b/src/detect-tls-cert-serial.c
@@ -140,7 +140,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->server_connp.cert0_serial);
         const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_serial;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-cert-subject.c b/src/detect-tls-cert-subject.c
index d22a686cbe..0e43a45a1a 100644
--- a/src/detect-tls-cert-subject.c
+++ b/src/detect-tls-cert-subject.c
@@ -130,7 +130,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->server_connp.cert0_subject);
         const uint8_t *data = (uint8_t *)ssl_state->server_connp.cert0_subject;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-certs.c b/src/detect-tls-certs.c
index 01244d1657..5eb7be2898 100644
--- a/src/detect-tls-certs.c
+++ b/src/detect-tls-certs.c
@@ -158,8 +158,8 @@ static InspectionBuffer *TlsCertsGetData(DetectEngineThreadCtx *det_ctx,
         return NULL;
     }
 
-    InspectionBufferSetup(buffer, cbdata->cert->cert_data,
-		          cbdata->cert->cert_len);
+    InspectionBufferSetup(
+            det_ctx, list_id, buffer, cbdata->cert->cert_data, cbdata->cert->cert_len);
     InspectionBufferApplyTransforms(buffer, transforms);
 
     SCReturnPtr(buffer, "InspectionBuffer");
diff --git a/src/detect-tls-ja3-hash.c b/src/detect-tls-ja3-hash.c
index 03787ce2cc..9787ecd3f1 100644
--- a/src/detect-tls-ja3-hash.c
+++ b/src/detect-tls-ja3-hash.c
@@ -153,7 +153,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->client_connp.ja3_hash);
         const uint8_t *data = (uint8_t *)ssl_state->client_connp.ja3_hash;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-ja3-string.c b/src/detect-tls-ja3-string.c
index 6869ea9604..76c44c8c0d 100644
--- a/src/detect-tls-ja3-string.c
+++ b/src/detect-tls-ja3-string.c
@@ -143,7 +143,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->client_connp.ja3_str->data);
         const uint8_t *data = (uint8_t *)ssl_state->client_connp.ja3_str->data;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-ja3s-hash.c b/src/detect-tls-ja3s-hash.c
index d8acf0344c..7dd7077da9 100644
--- a/src/detect-tls-ja3s-hash.c
+++ b/src/detect-tls-ja3s-hash.c
@@ -151,7 +151,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->server_connp.ja3_hash);
         const uint8_t *data = (uint8_t *)ssl_state->server_connp.ja3_hash;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-ja3s-string.c b/src/detect-tls-ja3s-string.c
index ea4c9aa5e4..7b22fce6c2 100644
--- a/src/detect-tls-ja3s-string.c
+++ b/src/detect-tls-ja3s-string.c
@@ -142,7 +142,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->server_connp.ja3_str->data);
         const uint8_t *data = (uint8_t *)ssl_state->server_connp.ja3_str->data;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c
index 0fe36c0208..5bcb4172a7 100644
--- a/src/detect-tls-sni.c
+++ b/src/detect-tls-sni.c
@@ -129,7 +129,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = strlen(ssl_state->client_connp.sni);
         const uint8_t *data = (uint8_t *)ssl_state->client_connp.sni;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
 
diff --git a/src/detect-transform-compress-whitespace.c b/src/detect-transform-compress-whitespace.c
index 0c720fb0f6..13b5f4d01e 100644
--- a/src/detect-transform-compress-whitespace.c
+++ b/src/detect-transform-compress-whitespace.c
@@ -161,7 +161,7 @@ static int DetectTransformCompressWhitespaceTest01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 9);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformCompressWhitespace(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -176,7 +176,7 @@ static int DetectTransformCompressWhitespaceTest02(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 9);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformDoubleWhitespace(&buffer);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -195,7 +195,7 @@ static int DetectTransformCompressWhitespaceTest03(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 10);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     FAIL_IF(TransformCompressWhitespaceValidate(buffer.inspect, buffer.inspect_len, NULL));
     PASS;
@@ -208,7 +208,7 @@ static int DetectTransformCompressWhitespaceTest04(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 9);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     TransformDoubleWhitespace(&buffer);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     FAIL_IF(TransformCompressWhitespaceValidate(buffer.inspect, buffer.inspect_len, NULL));
diff --git a/src/detect-transform-dotprefix.c b/src/detect-transform-dotprefix.c
index 22fe0ff5ee..061b0f1925 100644
--- a/src/detect-transform-dotprefix.c
+++ b/src/detect-transform-dotprefix.c
@@ -128,7 +128,7 @@ static int DetectTransformDotPrefixTest01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, input_len);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformDotPrefix(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -148,7 +148,7 @@ static int DetectTransformDotPrefixTest02(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, input_len);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformDotPrefix(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -182,4 +182,4 @@ static void DetectTransformDotPrefixRegisterTests(void)
     UtRegisterTest("DetectTransformDotPrefixTest02", DetectTransformDotPrefixTest02);
     UtRegisterTest("DetectTransformDotPrefixTest03", DetectTransformDotPrefixTest03);
 }
-#endif
\ No newline at end of file
+#endif
diff --git a/src/detect-transform-md5.c b/src/detect-transform-md5.c
index 7d891d8619..2e6d8d4ea6 100644
--- a/src/detect-transform-md5.c
+++ b/src/detect-transform-md5.c
@@ -99,7 +99,7 @@ static int DetectTransformToMd5Test01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 8);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformToMd5(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -112,4 +112,4 @@ static void DetectTransformToMd5RegisterTests(void)
     UtRegisterTest("DetectTransformToMd5Test01",
             DetectTransformToMd5Test01);
 }
-#endif
\ No newline at end of file
+#endif
diff --git a/src/detect-transform-sha1.c b/src/detect-transform-sha1.c
index 3f6e85ca56..6ff84b5ccb 100644
--- a/src/detect-transform-sha1.c
+++ b/src/detect-transform-sha1.c
@@ -100,7 +100,7 @@ static int DetectTransformToSha1Test01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 8);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformToSha1(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
diff --git a/src/detect-transform-sha256.c b/src/detect-transform-sha256.c
index c01cc9220b..af07454d8a 100644
--- a/src/detect-transform-sha256.c
+++ b/src/detect-transform-sha256.c
@@ -100,7 +100,7 @@ static int DetectTransformToSha256Test01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 8);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformToSha256(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -113,4 +113,4 @@ static void DetectTransformToSha256RegisterTests(void)
     UtRegisterTest("DetectTransformToSha256Test01",
             DetectTransformToSha256Test01);
 }
-#endif
\ No newline at end of file
+#endif
diff --git a/src/detect-transform-strip-whitespace.c b/src/detect-transform-strip-whitespace.c
index 6757941f8c..055a7e00d0 100644
--- a/src/detect-transform-strip-whitespace.c
+++ b/src/detect-transform-strip-whitespace.c
@@ -148,7 +148,7 @@ static int DetectTransformStripWhitespaceTest01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 8);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformStripWhitespace(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -163,7 +163,7 @@ static int DetectTransformStripWhitespaceTest02(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 8);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformDoubleWhitespace(&buffer);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
@@ -202,4 +202,4 @@ static void DetectTransformStripWhitespaceRegisterTests(void)
     UtRegisterTest("DetectTransformStripWhitespaceTest03",
             DetectTransformStripWhitespaceTest03);
 }
-#endif
\ No newline at end of file
+#endif
diff --git a/src/detect-transform-urldecode.c b/src/detect-transform-urldecode.c
index 50781c8f72..526561f2f9 100644
--- a/src/detect-transform-urldecode.c
+++ b/src/detect-transform-urldecode.c
@@ -136,7 +136,7 @@ static int DetectTransformUrlDecodeTest01(void)
 
     InspectionBuffer buffer;
     InspectionBufferInit(&buffer, 8);
-    InspectionBufferSetup(&buffer, input, input_len);
+    InspectionBufferSetup(NULL, -1, &buffer, input, input_len);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
     TransformUrlDecode(&buffer, NULL);
     PrintRawDataFp(stdout, buffer.inspect, buffer.inspect_len);
diff --git a/src/detect-udphdr.c b/src/detect-udphdr.c
index a8900048be..6c58a8883c 100644
--- a/src/detect-udphdr.c
+++ b/src/detect-udphdr.c
@@ -114,7 +114,7 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
         const uint32_t data_len = UDP_HEADER_LEN;
         const uint8_t *data = (const uint8_t *)p->udph;
 
-        InspectionBufferSetup(buffer, data, data_len);
+        InspectionBufferSetup(det_ctx, list_id, buffer, data, data_len);
         InspectionBufferApplyTransforms(buffer, transforms);
     }