diff --git a/src/detect-engine-mpm.c b/src/detect-engine-mpm.c index a6f5f4b969..05a927608d 100644 --- a/src/detect-engine-mpm.c +++ b/src/detect-engine-mpm.c @@ -3346,17 +3346,26 @@ uint32_t DetectPatternGetIdV2(MpmPatternIdStore *ht, void *ctx, Signature *s, ui SCReturnUInt(id); } -void DetectFigureFPAndId(DetectEngineCtx *de_ctx) -{ - typedef struct DetectFigureFPAndId_t_ { - PatIntId id; - uint16_t content_len; - uint32_t flags; - int sm_list; +typedef struct DetectFPAndItsId_ { + PatIntId id; + uint16_t content_len; + uint32_t flags; + int sm_list; - uint8_t *content; - } DetectFigureFPAndId_t; + uint8_t *content; +} DetectFPAndItsId; +/** + * \brief Figured out the FP and their respective content ids for all the + * sigs in the engine. + * + * \param de_ctx Detection engine context. + * + * \retval 0 On success. + * \retval -1 On failure. + */ +int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx) +{ uint32_t struct_total_size = 0; uint32_t content_total_size = 0; Signature *s = NULL; @@ -3365,7 +3374,7 @@ void DetectFigureFPAndId(DetectEngineCtx *de_ctx) s->mpm_sm = RetrieveFPForSigV2(s); if (s->mpm_sm != NULL) { DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; - struct_total_size += sizeof(DetectFigureFPAndId_t); + struct_total_size += sizeof(DetectFPAndItsId); content_total_size += cd->content_len; } } @@ -3373,17 +3382,17 @@ void DetectFigureFPAndId(DetectEngineCtx *de_ctx) /* array hash buffer - i've run out of ideas to name it */ uint8_t *ahb = SCMalloc(sizeof(uint8_t) * (struct_total_size + content_total_size)); if (ahb == NULL) - exit(EXIT_FAILURE); + return -1; PatIntId max_id = 0; - DetectFigureFPAndId_t *struct_offset = (DetectFigureFPAndId_t *)ahb; + DetectFPAndItsId *struct_offset = (DetectFPAndItsId *)ahb; uint8_t *content_offset = ahb + struct_total_size; for (s = de_ctx->sig_list; s != NULL; s = s->next) { if (s->mpm_sm != NULL) { int sm_list = SigMatchListSMBelongsTo(s, s->mpm_sm); BUG_ON(sm_list == -1); DetectContentData *cd = (DetectContentData *)s->mpm_sm->ctx; - DetectFigureFPAndId_t *dup = (DetectFigureFPAndId_t *)ahb; + DetectFPAndItsId *dup = (DetectFPAndItsId *)ahb; for (; dup != struct_offset; dup++) { if (dup->content_len != cd->content_len || dup->sm_list != sm_list || @@ -3413,5 +3422,5 @@ void DetectFigureFPAndId(DetectEngineCtx *de_ctx) de_ctx->max_fp_id = max_id; SCFree(ahb); - return; + return 0; } diff --git a/src/detect-engine-mpm.h b/src/detect-engine-mpm.h index 75328972eb..7fc385d100 100644 --- a/src/detect-engine-mpm.h +++ b/src/detect-engine-mpm.h @@ -85,7 +85,16 @@ int SignatureHasStreamContent(Signature *); SigMatch *RetrieveFPForSig(Signature *s); SigMatch *RetrieveFPForSigV2(Signature *s); -void DetectFigureFPAndId(DetectEngineCtx *de_ctx); +/** + * \brief Figured out the FP and their respective content ids for all the + * sigs in the engine. + * + * \param de_ctx Detection engine context. + * + * \retval 0 On success. + * \retval -1 On failure. + */ +int DetectSetFastPatternAndItsId(DetectEngineCtx *de_ctx); #endif /* __DETECT_ENGINE_MPM_H__ */ diff --git a/src/detect.c b/src/detect.c index c5eed62f28..532a2c4bf1 100644 --- a/src/detect.c +++ b/src/detect.c @@ -473,7 +473,8 @@ int SigLoadSignatures(DetectEngineCtx *de_ctx, char *sig_file, int sig_file_excl } /* Setup the signature group lookup structure and pattern matchers */ - SigGroupBuild(de_ctx); + if (SigGroupBuild(de_ctx) < 0) + goto end; ret = 0; @@ -4379,11 +4380,13 @@ int SigAddressPrepareStage5(DetectEngineCtx *de_ctx) { * \param de_ctx Pointer to the Detection Engine Context whose Signatures have * to be processed * - * \retval 0 Always + * \retval 0 On Success. + * \retval -1 On failure. */ int SigGroupBuild(DetectEngineCtx *de_ctx) { - DetectFigureFPAndId(de_ctx); + if (DetectSetFastPatternAndItsId(de_ctx) < 0) + return -1; /* if we are using single sgh_mpm_context then let us init the standard mpm * contexts using the mpm_ctx factory */