flowint: further setup fixes and cleanups

pull/564/head
Victor Julien 12 years ago
parent 8080494e9a
commit 3601091952

@ -233,11 +233,9 @@ int DetectFlowintMatch(ThreadVars *t, DetectEngineThreadCtx *det_ctx,
* \retval NULL if invalid option * \retval NULL if invalid option
* \retval DetectFlowintData pointer with the flowint parsed * \retval DetectFlowintData pointer with the flowint parsed
*/ */
DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx, DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx, char *rawstr)
char *rawstr)
{ {
DetectFlowintData *sfd = NULL; DetectFlowintData *sfd = NULL;
char *str = rawstr;
char *varname = NULL; char *varname = NULL;
char *varval = NULL; char *varval = NULL;
char *modstr = NULL; char *modstr = NULL;
@ -257,15 +255,14 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx,
/* Get our flowint varname */ /* Get our flowint varname */
res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr); res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 1, &str_ptr);
if (res < 0) { if (res < 0 || str_ptr == NULL) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error; goto error;
} }
varname = (char *)str_ptr; varname = (char *)str_ptr;
res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 2, res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 2, &str_ptr);
&str_ptr); if (res < 0 || str_ptr == NULL) {
if (res < 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error; goto error;
} }
@ -310,25 +307,16 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx,
if (ret < 4) if (ret < 4)
goto error; goto error;
res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 3, res = pcre_get_substring((char *) rawstr, ov, MAX_SUBSTRINGS, 3, &str_ptr);
&str_ptr);
varval = (char *)str_ptr; varval = (char *)str_ptr;
if (res < 0 || strcmp(varval, "") == 0) { if (res < 0 || varval == NULL || strcmp(varval, "") == 0) {
SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed"); SCLogError(SC_ERR_PCRE_GET_SUBSTRING, "pcre_get_substring failed");
goto error; goto error;
} }
/* get the target value to operate with if (varval[0] >= '0' && varval[0] <= '9') { /* is digit, look at the regexp */
*(it should be a value or another var) */
str = SCStrdup(varval);
if (unlikely(str == NULL)) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc from strdup failed");
goto error;
}
if (str[0] >= '0' && str[0] <= '9') { /* is digit, look at the regexp */
sfd->targettype = FLOWINT_TARGET_VAL; sfd->targettype = FLOWINT_TARGET_VAL;
value_long = atoll(str); value_long = atoll(varval);
if (value_long > UINT32_MAX) { if (value_long > UINT32_MAX) {
SCLogDebug("DetectFlowintParse: Cannot load this value." SCLogDebug("DetectFlowintParse: Cannot load this value."
" Values should be between 0 and %"PRIu32, UINT32_MAX); " Values should be between 0 and %"PRIu32, UINT32_MAX);
@ -336,7 +324,11 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx,
} }
} else { } else {
sfd->targettype = FLOWINT_TARGET_VAR; sfd->targettype = FLOWINT_TARGET_VAR;
sfd->target.tvar.name = str; sfd->target.tvar.name = SCStrdup(varval);
if (unlikely(sfd->target.tvar.name == NULL)) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc from strdup failed");
goto error;
}
} }
} else { } else {
sfd->targettype = FLOWINT_TARGET_SELF; sfd->targettype = FLOWINT_TARGET_SELF;
@ -344,18 +336,19 @@ DetectFlowintData *DetectFlowintParse(DetectEngineCtx *de_ctx,
/* Set the name of the origin var to modify/compared with the target */ /* Set the name of the origin var to modify/compared with the target */
sfd->name = SCStrdup(varname); sfd->name = SCStrdup(varname);
if (unlikely(sfd->name == NULL)) {
SCLogError(SC_ERR_MEM_ALLOC, "malloc from strdup failed");
goto error;
}
if (de_ctx != NULL) if (de_ctx != NULL)
sfd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWINT); sfd->idx = VariableNameGetIdx(de_ctx, varname, DETECT_FLOWINT);
sfd->target.value = (uint32_t) value_long; sfd->target.value = (uint32_t) value_long;
sfd->modifier = modifier; sfd->modifier = modifier;
if (varname) pcre_free_substring(varname);
pcre_free_substring(varname); pcre_free_substring(modstr);
if (varval) if (varval)
pcre_free_substring(varval); pcre_free_substring(varval);
if (modstr)
pcre_free_substring(modstr);
return sfd; return sfd;
error: error:
if (varname) if (varname)

Loading…
Cancel
Save