From 7e97dfd521383522dcdb8021068e229f14daf32a Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Thu, 19 Feb 2026 16:37:02 +0100
Subject: [PATCH] detect: replace stack alloc by member of
 DetectEngineThreadCtx

To avoid running a big (when many signatures) stack allocation
on each detection loop with postmatches

Ticket: 8001
---
 src/detect-engine.c | 6 ++++++
 src/detect.c        | 9 +++------
 src/detect.h        | 3 +++
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/detect-engine.c b/src/detect-engine.c
index eeea4483e0..2aac613754 100644
--- a/src/detect-engine.c
+++ b/src/detect-engine.c
@@ -3333,6 +3333,10 @@ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *
         if (det_ctx->match_array == NULL) {
             return TM_ECODE_FAILED;
         }
+        det_ctx->replace = SCCalloc(de_ctx->sig_array_len, sizeof(Signature *));
+        if (det_ctx->replace == NULL) {
+            return TM_ECODE_FAILED;
+        }
 
         RuleMatchCandidateTxArrayInit(det_ctx, de_ctx->sig_array_len);
     }
@@ -3585,6 +3589,8 @@ static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
     }
     if (det_ctx->match_array != NULL)
         SCFree(det_ctx->match_array);
+    if (det_ctx->replace != NULL)
+        SCFree(det_ctx->replace);
 
     RuleMatchCandidateTxArrayFree(det_ctx);
 
diff --git a/src/detect.c b/src/detect.c
index da7d32755d..125141f36d 100644
--- a/src/detect.c
+++ b/src/detect.c
@@ -793,12 +793,9 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                 /* undo "prefetch" */
                 if (next_s)
                     match_array--;
-                /* create temporary rule pointer array starting
-                 * at where we are in the current match array */
-                const Signature *replace[de_ctx->sig_array_len]; // TODO heap?
                 SCLogDebug("sig_array_len %u det_ctx->pmq.rule_id_array_cnt %u",
                         de_ctx->sig_array_len, det_ctx->pmq.rule_id_array_cnt);
-                const Signature **r = replace;
+                const Signature **r = det_ctx->replace;
                 for (uint32_t x = 0; x < match_cnt; x++) {
                     *r++ = match_array[x];
                     SCLogDebug("appended %u", match_array[x]->id);
@@ -814,7 +811,7 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                     }
                 }
                 if (match_cnt > 1) {
-                    qsort(replace, match_cnt, sizeof(Signature *), SortHelper);
+                    qsort(det_ctx->replace, match_cnt, sizeof(Signature *), SortHelper);
                 }
                 /* rewrite match_array to include the new additions, and deduplicate
                  * while at it. */
@@ -828,7 +825,7 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                         continue;
                     }
                     last_sig = *m;
-                    *m++ = (Signature *)replace[x];
+                    *m++ = (Signature *)det_ctx->replace[x];
                 }
                 match_cnt -= skipped;
                 /* prefetch next */
diff --git a/src/detect.h b/src/detect.h
index 9f14e1216e..f063da047c 100644
--- a/src/detect.h
+++ b/src/detect.h
@@ -1332,6 +1332,9 @@ typedef struct DetectEngineThreadCtx_ {
     /** array of signature pointers we're going to inspect in the detection
      *  loop. */
     Signature **match_array;
+    /** temporary array of signature pointers we're going to inspect in the
+     *   detection loop. */
+    const Signature **replace;
     /** size of the array in items (mem size if * sizeof(Signature *)
      *  Only used during initialization. */
     uint32_t match_array_len;