From: Philippe Antoine <pantoine@oisf.net>
Date: Wed, 23 Nov 2022 14:07:56 +0000 (+0100)
Subject: quic: do not use stack for inspection buffer
X-Git-Tag: suricata-7.0.0-rc1~298
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=4daee8bae1efefe1f32b0bff8e0d9f25a5bee82f;p=thirdparty%2Fsuricata.git

quic: do not use stack for inspection buffer

Make the inspection buffer copy the content in one buffer it owns.

Ticket: #5707
---

diff --git a/src/util-ja3.c b/src/util-ja3.c
index 270e3e42d8..78a49a61bd 100644
--- a/src/util-ja3.c
+++ b/src/util-ja3.c
@@ -277,7 +277,8 @@ InspectionBuffer *Ja3DetectGetHash(DetectEngineThreadCtx *det_ctx,
         // this adds a final zero
         SCMd5HashBufferToHex(b, b_len, (char *)ja3_hash, SC_MD5_HEX_LEN + 1);
 
-        InspectionBufferSetup(det_ctx, list_id, buffer, ja3_hash, SC_MD5_HEX_LEN);
+        InspectionBufferSetup(det_ctx, list_id, buffer, NULL, 0);
+        InspectionBufferCopy(buffer, ja3_hash, SC_MD5_HEX_LEN);
         InspectionBufferApplyTransforms(buffer, transforms);
     }
     return buffer;