From c5d83d081e9cd77e49d1477b26e276c979e29dab Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 4 Aug 2023 17:08:06 +0200 Subject: [PATCH] detect/file: use util to turn keyword to nocase This changes the way the pattern is stored by making it lowercase. --- src/detect-filemagic.c | 7 +------ src/detect-filename.c | 14 ++------------ 2 files changed, 3 insertions(+), 18 deletions(-) diff --git a/src/detect-filemagic.c b/src/detect-filemagic.c index 84979d6d91..b1c53593dc 100644 --- a/src/detect-filemagic.c +++ b/src/detect-filemagic.c @@ -222,13 +222,8 @@ static int DetectFilemagicSetup (DetectEngineCtx *de_ctx, Signature *s, const ch return -1; DetectContentData *cd = (DetectContentData *)sm->ctx; - cd->flags |= DETECT_CONTENT_NOCASE; - /* Recreate the context with nocase chars */ - SpmDestroyCtx(cd->spm_ctx); - cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx); - if (cd->spm_ctx == NULL) { + if (DetectContentConvertToNocase(de_ctx, cd) != 0) return -1; - } if (DetectEngineContentModifierBufferSetup( de_ctx, s, NULL, DETECT_FILE_MAGIC, g_file_magic_buffer_id, s->alproto) < 0) return -1; diff --git a/src/detect-filename.c b/src/detect-filename.c index ec9f81d457..fc6e2fc718 100644 --- a/src/detect-filename.c +++ b/src/detect-filename.c @@ -148,14 +148,9 @@ static int DetectFileextSetup(DetectEngineCtx *de_ctx, Signature *s, const char return -1; DetectContentData *cd = (DetectContentData *)sm->ctx; - cd->flags |= DETECT_CONTENT_NOCASE; cd->flags |= DETECT_CONTENT_ENDS_WITH; - /* Recreate the context with nocase chars */ - SpmDestroyCtx(cd->spm_ctx); - cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx); - if (cd->spm_ctx == NULL) { + if (DetectContentConvertToNocase(de_ctx, cd) != 0) return -1; - } if (DetectEngineContentModifierBufferSetup( de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0) return -1; @@ -191,13 +186,8 @@ static int DetectFilenameSetup (DetectEngineCtx *de_ctx, Signature *s, const cha return -1; DetectContentData *cd = (DetectContentData *)sm->ctx; - cd->flags |= DETECT_CONTENT_NOCASE; - /* Recreate the context with nocase chars */ - SpmDestroyCtx(cd->spm_ctx); - cd->spm_ctx = SpmInitCtx(cd->content, cd->content_len, 1, de_ctx->spm_global_thread_ctx); - if (cd->spm_ctx == NULL) { + if (DetectContentConvertToNocase(de_ctx, cd) != 0) return -1; - } if (DetectEngineContentModifierBufferSetup( de_ctx, s, NULL, DETECT_FILE_NAME, g_file_name_buffer_id, s->alproto) < 0) return -1;