From: Ken Steele <ken@tilera.com>
Date: Wed, 26 Feb 2014 21:15:42 +0000 (-0500)
Subject: Store case-insensitive patterns as lowercase.
X-Git-Tag: suricata-2.0rc2~44
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=cd1c18d98194b5a0c249680f0eaa1bc3722bec92;p=thirdparty%2Fsuricata.git

Store case-insensitive patterns as lowercase.

This is required because SCMemcmpLowercase() expects it first argument
to be already lowercase for the comparison. This is done by using
memcpy_tolower() for NO_CASE patterns.

This addresses code review comments from Victor.
---

diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c
index 53cc756280..5af9109781 100644
--- a/src/detect-engine-mpm.c
+++ b/src/detect-engine-mpm.c
@@ -2865,7 +2865,7 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
                     if (SCMemcmpLowercase(dup->content, content, content_len) != 0)
                         continue;
                 } else {
-                    // Case sensitive matching
+                    /* Case sensitive matching */
                     if (SCMemcmp(dup->content, content, content_len) != 0)
                         continue;
                 }
@@ -2879,8 +2879,10 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
                 continue;
             }
 
-            /* Not found, so new content. Give it a new ID and add it to the array.
-             * Copy the content at the end of the content array. */
+            /* Not found, so new content. Give it a new ID and add it
+             * to the array.  Copy the content at the end of the
+             * content array.
+             */
             struct_offset->id = max_id++;
             cd->id = struct_offset->id;
             struct_offset->content_len = content_len;
@@ -2889,7 +2891,17 @@ int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx)
             struct_offset->flags = flags;
 
             content_offset += content_len;
-            memcpy(struct_offset->content, content, content_len);
+
+            if (flags & DETECT_CONTENT_NOCASE) {
+              /* Need to store case-insensitive patterns as lower case
+               * because SCMemcmpLowercase() above assumes that all
+               * patterns are stored lower case so that it doesn't
+               * need to relower its first argument.
+               */
+              memcpy_tolower(struct_offset->content, content, content_len);
+            } else {
+              memcpy(struct_offset->content, content, content_len);
+            }
 
             struct_offset++;
         } /* if (s->mpm_sm != NULL) */