From 03d676531ab99b88bd86e5c175d19e0c2f5dc8df Mon Sep 17 00:00:00 2001
From: Jeff Lucovsky <jlucovsky@oisf.net>
Date: Sun, 17 Aug 2025 10:23:44 -0400
Subject: [PATCH] detect/from_base64: Support keyword w/no opts

Issue: 7853

Support the use of `from_base64` with no optional values. In this case,
the default values for:
- mode RFC4648
- offset: 0
- bytes: buffer size
will be used.
---
 rust/src/detect/transforms/base64.rs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/rust/src/detect/transforms/base64.rs b/rust/src/detect/transforms/base64.rs
index ee3ec1ba15..e9de8a9fe9 100644
--- a/rust/src/detect/transforms/base64.rs
+++ b/rust/src/detect/transforms/base64.rs
@@ -191,7 +191,8 @@ fn parse_transform_base64(
 
 unsafe fn base64_parse(c_arg: *const c_char) -> *mut DetectTransformFromBase64Data {
     if c_arg.is_null() {
-        return std::ptr::null_mut();
+        let detect = DetectTransformFromBase64Data::default();
+        return Box::into_raw(Box::new(detect));
     }
 
     if let Ok(arg) = CStr::from_ptr(c_arg).to_str() {