diff --git a/src/detect-engine-siggroup.c b/src/detect-engine-siggroup.c index 08c298159c..a7ecbafd9a 100644 --- a/src/detect-engine-siggroup.c +++ b/src/detect-engine-siggroup.c @@ -1689,7 +1689,9 @@ void SigGroupHeadSetFilestoreCount(DetectEngineCtx *de_ctx, SigGroupHead *sgh) return; } -/* build an array of rule id's for sigs with no mpm */ +/** \brief build an array of rule id's for sigs with no mpm + * Also updated de_ctx::non_mpm_store_cnt_max to track the highest cnt + */ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh) { Signature *s = NULL; @@ -1738,6 +1740,11 @@ int SigGroupHeadBuildNonMpmArray(DetectEngineCtx *de_ctx, SigGroupHead *sgh) sgh->non_mpm_store_cnt++; } } + + /* track highest cnt for any sgh in our de_ctx */ + if (sgh->non_mpm_store_cnt > de_ctx->non_mpm_store_cnt_max) + de_ctx->non_mpm_store_cnt_max = sgh->non_mpm_store_cnt; + return 0; } diff --git a/src/detect-engine.c b/src/detect-engine.c index 211d330f56..cf43590fc4 100644 --- a/src/detect-engine.c +++ b/src/detect-engine.c @@ -1290,8 +1290,12 @@ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx * PmqSetup(&det_ctx->smsg_pmq[i], de_ctx->max_fp_id); } - det_ctx->non_mpm_id_array = SCCalloc(32000, sizeof(SigIntId)); // TODO proper size or dynamicly grow - BUG_ON(det_ctx->non_mpm_id_array == NULL); + /* sized to the max of our sgh settings. A max setting of 0 implies that all + * sgh's have: sgh->non_mpm_store_cnt == 0 */ + if (de_ctx->non_mpm_store_cnt_max > 0) { + det_ctx->non_mpm_id_array = SCCalloc(de_ctx->non_mpm_store_cnt_max, sizeof(SigIntId)); + BUG_ON(det_ctx->non_mpm_id_array == NULL); + } /* IP-ONLY */ DetectEngineIPOnlyThreadInit(de_ctx,&det_ctx->io_ctx); diff --git a/src/detect.h b/src/detect.h index 5ff05bf954..4a7ce480fc 100644 --- a/src/detect.h +++ b/src/detect.h @@ -587,6 +587,10 @@ typedef struct DetectEngineCtx_ { uint32_t signum; + /** Maximum value of all our sgh's non_mpm_store_cnt setting, + * used to alloc det_ctx::non_mpm_id_array */ + uint32_t non_mpm_store_cnt_max; + /* used by the signature ordering module */ struct SCSigOrderFunc_ *sc_sig_order_funcs; @@ -977,8 +981,8 @@ typedef struct SigGroupHead_ { SignatureMask *mask_array; #endif - SignatureNonMpmStore *non_mpm_store_array; - uint32_t non_mpm_store_cnt; // size is cnt * sizeof(SignatureNonMpmStore) + SignatureNonMpmStore *non_mpm_store_array; // size is non_mpm_store_cnt * sizeof(SignatureNonMpmStore) + uint32_t non_mpm_store_cnt; /* pattern matcher instances */ MpmCtx *mpm_proto_other_ctx;