Store case-insensitive patterns as lowercase.

This is required because SCMemcmpLowercase() expects it first argument
to be already lowercase for the comparison. This is done by using
memcpy_tolower() for NO_CASE patterns.

This addresses code review comments from Victor.

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index 53cc756280b99d339eda2e412940ff5b910de285..5af91097811253e7900892f6012d4699561fff61 100644 (file)
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -2865,7 +2865,7 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
                     if (SCMemcmpLowercase(dup->content, content, content_len) != 0)
                         continue;
                 } else {
-                    // Case sensitive matching
+                    /* Case sensitive matching */
                     if (SCMemcmp(dup->content, content, content_len) != 0)
                         continue;
                 }
@@ -2879,8 +2879,10 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
                 continue;
             }
 
-            /* Not found, so new content. Give it a new ID and add it to the array.
-             * Copy the content at the end of the content array. */
+            /* Not found, so new content. Give it a new ID and add it
+             * to the array.  Copy the content at the end of the
+             * content array.
+             */
             struct_offset->id = max_id++;
             cd->id = struct_offset->id;
             struct_offset->content_len = content_len;
@@ -2889,7 +2891,17 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
             struct_offset->flags = flags;
 
             content_offset += content_len;
-            memcpy(struct_offset->content, content, content_len);
+
+            if (flags & DETECT_CONTENT_NOCASE) {
+              /* Need to store case-insensitive patterns as lower case
+               * because SCMemcmpLowercase() above assumes that all
+               * patterns are stored lower case so that it doesn't
+               * need to relower its first argument.
+               */
+              memcpy_tolower(struct_offset->content, content, content_len);
+            } else {
+              memcpy(struct_offset->content, content, content_len);
+            }
 
             struct_offset++;
         } /* if (s->mpm_sm != NULL) */