decode: use pointer for PacketContextData

By adding a pointer instead of the structure in the alert info
we spare some memory.

diff --git a/src/decode.c b/src/decode.c
index ce8726d2a89aae4fd6d959cd0352f54190022bd3..6167d45225482d36923d6b02e64ea0581d644600 100644 (file)
--- a/src/decode.c
+++ b/src/decode.c
@@ -149,16 +149,13 @@ void PacketAlertRecycle(PacketAlert *pa_array)
 {
     if (pa_array != NULL) {
         for (int i = 0; i < packet_alert_max; i++) {
-            if (pa_array[i].json_info.next != NULL) {
-                struct PacketContextData *current_json = pa_array[i].json_info.next;
-                while (current_json) {
-                    struct PacketContextData *next_json = current_json->next;
-                    SCFree(current_json);
-                    current_json = next_json;
-                }
+            struct PacketContextData *current_json = pa_array[i].json_info;
+            while (current_json) {
+                struct PacketContextData *next_json = current_json->next;
+                SCFree(current_json);
+                current_json = next_json;
             }
-            pa_array[i].json_info.json_string = NULL;
-            pa_array[i].json_info.next = NULL;
+            pa_array[i].json_info = NULL;
         }
     }
 }
@@ -167,14 +164,11 @@ void PacketAlertFree(PacketAlert *pa)
 {
     if (pa != NULL) {
         for (int i = 0; i < packet_alert_max; i++) {
-            /* first item is not allocated so start at second one */
-            if (pa[i].json_info.next != NULL) {
-                struct PacketContextData *allocated_json = pa[i].json_info.next;
-                while (allocated_json) {
-                    struct PacketContextData *next_json = allocated_json->next;
-                    SCFree(allocated_json);
-                    allocated_json = next_json;
-                }
+            struct PacketContextData *allocated_json = pa[i].json_info;
+            while (allocated_json) {
+                struct PacketContextData *next_json = allocated_json->next;
+                SCFree(allocated_json);
+                allocated_json = next_json;
             }
         }
         SCFree(pa);

diff --git a/src/decode.h b/src/decode.h
index d5f8472e8b2d468adc1e358c42db56a60c4f7695..9bb97a13f436a51c692fb6714348664e2c6df8f2 100644 (file)
--- a/src/decode.h
+++ b/src/decode.h
@@ -252,7 +252,7 @@ typedef struct PacketAlert_ {
     const struct Signature_ *s;
     uint64_t tx_id; /* Used for sorting */
     int64_t frame_id;
-    struct PacketContextData json_info;
+    struct PacketContextData *json_info;
 } PacketAlert;
 
 /**

diff --git a/src/detect-engine-alert.c b/src/detect-engine-alert.c
index 82bdcff59da6e8d95f68046c70c90e0ad8dc6525..f062cdb14ca37d04817607c01f2543b3000cc085 100644 (file)
--- a/src/detect-engine-alert.c
+++ b/src/detect-engine-alert.c
@@ -297,12 +297,19 @@ static inline PacketAlert PacketAlertSet(
     /* Set tx_id if the frame has it */
     pa.tx_id = tx_id;
     pa.frame_id = (alert_flags & PACKET_ALERT_FLAG_FRAME) ? det_ctx->frame_id : 0;
-    pa.json_info.json_string = NULL;
-    pa.json_info.next = NULL;
+    pa.json_info = NULL;
     if (det_ctx->json_content_len) {
         /* We have some JSON attached in the current detection so let's try
            to see if some need to be used for current signature. */
-        struct PacketContextData *current_json = &pa.json_info;
+        struct PacketContextData *current_json = pa.json_info;
+        if (current_json == NULL) {
+            current_json = SCCalloc(1, sizeof(struct PacketContextData));
+            if (current_json == NULL) {
+                /* Allocation error, let's return now */
+                return pa;
+            }
+            pa.json_info = current_json;
+        }
         for (size_t i = 0; i < det_ctx->json_content_len; i++) {
             if (s == det_ctx->json_content[i].id) {
                 if (current_json->json_string != NULL) {

diff --git a/src/output-json-alert.c b/src/output-json-alert.c
index a89c3b075cc17cba27fc64ab6203327d8f5ade40..9a8923cc5f690416b76ff89da8ed46e7983109bd 100644 (file)
--- a/src/output-json-alert.c
+++ b/src/output-json-alert.c
@@ -253,9 +253,9 @@ void AlertJsonHeader(const Packet *p, const PacketAlert *pa, SCJsonBuilder *js,
         AlertJsonMetadata(pa, js);
     }
 
-    if (pa->json_info.json_string != NULL) {
+    if (pa->json_info != NULL) {
         SCJbOpenObject(js, "context");
-        const struct PacketContextData *json_info = &pa->json_info;
+        const struct PacketContextData *json_info = pa->json_info;
         while (json_info) {
             SCJbSetFormatted(js, json_info->json_string);
             json_info = json_info->next;