detect/engine: helper to know if a transform happens in-place

(cherry picked from commit 4c42998feb)

rust/sys/src/sys.rs

@@ -242,6 +242,9 @@ extern "C" {
 extern "C" {
     pub fn SCInspectionBufferTruncate(buffer: *mut InspectionBuffer, buf_len: u32);
 }
+extern "C" {
+    pub fn SCInspectionBufferInPlace(buffer: *const InspectionBuffer) -> bool;
+}
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
 pub struct Flow_ {

src/detect-engine-inspect-buffer.c

@@ -255,3 +255,10 @@ void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_l
         buffer->initialized = true;
     }
 }
+
+// Returns wether the inspection buffer will make the transform run in-place
+// Especially useful for transforms that produces an output longer than the input
+bool SCInspectionBufferInPlace(const InspectionBuffer *buffer)
+{
+    return buffer->inspect == buffer->buf;
+}

src/detect-engine-inspect-buffer.h

@@ -72,5 +72,6 @@ void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer
         const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len);
 InspectionBuffer *InspectionBufferMultipleForListGet(
         DetectEngineThreadCtx *det_ctx, const int list_id, uint32_t local_id);
+bool SCInspectionBufferInPlace(const InspectionBuffer *buffer);
 
 #endif /* SURICATA_DETECT_ENGINE_INSPECT_BUFFER_H */