From c64a1f6a092a0b8f862375519a53ec979653e832 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 30 Sep 2021 15:13:13 +0200
Subject: [PATCH] pcre: use thread-storage for matches

---
 src/detect-pcre.c | 27 +++++++++++++++++++++++++--
 src/detect-pcre.h |  1 +
 2 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/detect-pcre.c b/src/detect-pcre.c
index 740651afb7..bb70a70cd5 100644
--- a/src/detect-pcre.c
+++ b/src/detect-pcre.c
@@ -200,7 +200,9 @@ int DetectPcrePayloadMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
     }
 
     /* run the actual pcre detection */
-    pcre2_match_data *match = pcre2_match_data_create_from_pattern(pe->parse_regex.regex, NULL);
+    pcre2_match_data *match =
+            (pcre2_match_data *)DetectThreadCtxGetKeywordThreadCtx(det_ctx, pe->thread_ctx_id);
+
     ret = DetectPcreExec(det_ctx, pe, (char *)ptr, len, start_offset, 0, match);
     SCLogDebug("ret %d (negating %s)", ret, (pe->flags & DETECT_PCRE_NEGATE) ? "set" : "not set");
 
@@ -303,7 +305,6 @@ int DetectPcrePayloadMatch(DetectEngineThreadCtx *det_ctx, const Signature *s,
         SCLogDebug("pcre had matching error");
         ret = 0;
     }
-    pcre2_match_data_free(match);
     SCReturnInt(ret);
 }
 
@@ -830,6 +831,21 @@ error:
     return -1;
 }
 
+static void *DetectPcreThreadInit(void *data)
+{
+    DetectPcreData *pd = (DetectPcreData *)data;
+    pcre2_match_data *match = pcre2_match_data_create_from_pattern(pd->parse_regex.regex, NULL);
+    return match;
+}
+
+static void DetectPcreThreadFree(void *ctx)
+{
+    if (ctx != NULL) {
+        pcre2_match_data *match = (pcre2_match_data *)ctx;
+        pcre2_match_data_free(match);
+    }
+}
+
 static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, const char *regexstr)
 {
     SCEnter();
@@ -847,6 +863,11 @@ static int DetectPcreSetup (DetectEngineCtx *de_ctx, Signature *s, const char *r
     if (DetectPcreParseCapture(regexstr, de_ctx, pd, capture_names) < 0)
         goto error;
 
+    pd->thread_ctx_id = DetectRegisterThreadCtxFuncs(
+            de_ctx, "pcre", DetectPcreThreadInit, (void *)pd, DetectPcreThreadFree, 0);
+    if (pd->thread_ctx_id == -1)
+        goto error;
+
     int sm_list = -1;
     if (s->init_data->list != DETECT_SM_LIST_NOTSET) {
         if (parsed_sm_list != DETECT_SM_LIST_NOTSET && parsed_sm_list != s->init_data->list) {
@@ -934,6 +955,8 @@ static void DetectPcreFree(DetectEngineCtx *de_ctx, void *ptr)
 
     DetectPcreData *pd = (DetectPcreData *)ptr;
     DetectParseFreeRegex(&pd->parse_regex);
+    DetectUnregisterThreadCtxFuncs(de_ctx, NULL, pd, "pcre");
+
     SCFree(pd);
 
     return;
diff --git a/src/detect-pcre.h b/src/detect-pcre.h
index 1c28466405..a7d33e7ffb 100644
--- a/src/detect-pcre.h
+++ b/src/detect-pcre.h
@@ -45,6 +45,7 @@ typedef struct DetectPcreData_ {
     uint8_t idx;
     uint8_t captypes[DETECT_PCRE_CAPTURE_MAX];
     uint32_t capids[DETECT_PCRE_CAPTURE_MAX];
+    int thread_ctx_id;
 } DetectPcreData;
 
 /* prototypes */