From e3f2b3418aa3aa33e4007fe5e3a7db59b9279b8c Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 17 Dec 2023 18:02:35 +0100 Subject: [PATCH] detect/content-inspect: use of replace keyword is rare Hint compiler about this. --- src/detect-engine-content-inspection.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/detect-engine-content-inspection.c b/src/detect-engine-content-inspection.c index 81f2e30f31..b204d1edaa 100644 --- a/src/detect-engine-content-inspection.c +++ b/src/detect-engine-content-inspection.c @@ -337,7 +337,7 @@ static int DetectEngineContentInspectionInternal(DetectEngineThreadCtx *det_ctx, if ((cd->flags & DETECT_CONTENT_ENDS_WITH) == 0 || match_offset == buffer_len) { /* Match branch, add replace to the list if needed */ - if (cd->flags & DETECT_CONTENT_REPLACE) { + if (unlikely(cd->flags & DETECT_CONTENT_REPLACE)) { if (inspection_mode == DETECT_ENGINE_CONTENT_INSPECTION_MODE_PAYLOAD) { /* we will need to replace content if match is confirmed * cast to non-const as replace writes to it. */ -- 2.47.2