detect: properly size det_ctx::non_mpm_id_array

Track which sgh has the higest non-mpm sig count and use that value
to size the det_ctx::non_mpm_id_array array.

src/detect-engine-siggroup.c

@@ -1689,7 +1689,9 @@ void SigGroupHeadSetFilestoreCount(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
     return;
 }
 
-/* build an array of rule id's for sigs with no mpm */
+/** \brief build an array of rule id's for sigs with no mpm
+ *  Also updated de_ctx::non_mpm_store_cnt_max to track the highest cnt
+ */
 int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
 {
     Signature *s = NULL;
@@ -1738,6 +1740,11 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh)
             sgh->non_mpm_store_cnt++;
         }
     }
+
+    /* track highest cnt for any sgh in our de_ctx */
+    if (sgh->non_mpm_store_cnt > de_ctx->non_mpm_store_cnt_max)
+        de_ctx->non_mpm_store_cnt_max = sgh->non_mpm_store_cnt;
+
     return 0;
 }
 

src/detect-engine.c

@@ -1290,8 +1290,12 @@ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *
         PmqSetup(&det_ctx->smsg_pmq[i], de_ctx->max_fp_id);
     }
 
-    det_ctx->non_mpm_id_array =  SCCalloc(32000, sizeof(SigIntId)); // TODO proper size or dynamicly grow
-    BUG_ON(det_ctx->non_mpm_id_array == NULL);
+    /* sized to the max of our sgh settings. A max setting of 0 implies that all
+     * sgh's have: sgh->non_mpm_store_cnt == 0 */
+    if (de_ctx->non_mpm_store_cnt_max > 0) {
+        det_ctx->non_mpm_id_array =  SCCalloc(de_ctx->non_mpm_store_cnt_max, sizeof(SigIntId));
+        BUG_ON(det_ctx->non_mpm_id_array == NULL);
+    }
 
     /* IP-ONLY */
     DetectEngineIPOnlyThreadInit(de_ctx,&det_ctx->io_ctx);

src/detect.h

@@ -587,6 +587,10 @@ typedef struct DetectEngineCtx_ {
 
     uint32_t signum;
 
+    /** Maximum value of all our sgh's non_mpm_store_cnt setting,
+     *  used to alloc det_ctx::non_mpm_id_array */
+    uint32_t non_mpm_store_cnt_max;
+
     /* used by the signature ordering module */
     struct SCSigOrderFunc_ *sc_sig_order_funcs;
 
@@ -977,8 +981,8 @@ typedef struct SigGroupHead_ {
     SignatureMask *mask_array;
 #endif
 
-    SignatureNonMpmStore *non_mpm_store_array;
-    uint32_t non_mpm_store_cnt; // size is cnt * sizeof(SignatureNonMpmStore)
+    SignatureNonMpmStore *non_mpm_store_array; // size is non_mpm_store_cnt * sizeof(SignatureNonMpmStore)
+    uint32_t non_mpm_store_cnt;
 
     /* pattern matcher instances */
     MpmCtx *mpm_proto_other_ctx;