detect: replace stack alloc by member of DetectEngineThreadCtx

To avoid running a big (when many signatures) stack allocation
on each detection loop with postmatches

Ticket: 8001

Author: catenacyber

src/detect-engine.c

@@ -3333,6 +3333,10 @@ static TmEcode ThreadCtxDoInit (DetectEngineCtx *de_ctx, DetectEngineThreadCtx *
         if (det_ctx->match_array == NULL) {
             return TM_ECODE_FAILED;
         }
+        det_ctx->replace = SCCalloc(de_ctx->sig_array_len, sizeof(Signature *));
+        if (det_ctx->replace == NULL) {
+            return TM_ECODE_FAILED;
+        }
 
         RuleMatchCandidateTxArrayInit(det_ctx, de_ctx->sig_array_len);
     }
@@ -3585,6 +3589,8 @@ static void DetectEngineThreadCtxFree(DetectEngineThreadCtx *det_ctx)
     }
     if (det_ctx->match_array != NULL)
         SCFree(det_ctx->match_array);
+    if (det_ctx->replace != NULL)
+        SCFree(det_ctx->replace);
 
     RuleMatchCandidateTxArrayFree(det_ctx);
 

src/detect.c

@@ -793,12 +793,9 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                 /* undo "prefetch" */
                 if (next_s)
                     match_array--;
-                /* create temporary rule pointer array starting
-                 * at where we are in the current match array */
-                const Signature *replace[de_ctx->sig_array_len]; // TODO heap?
                 SCLogDebug("sig_array_len %u det_ctx->pmq.rule_id_array_cnt %u",
                         de_ctx->sig_array_len, det_ctx->pmq.rule_id_array_cnt);
-                const Signature **r = replace;
+                const Signature **r = det_ctx->replace;
                 for (uint32_t x = 0; x < match_cnt; x++) {
                     *r++ = match_array[x];
                     SCLogDebug("appended %u", match_array[x]->id);
@@ -814,7 +811,7 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                     }
                 }
                 if (match_cnt > 1) {
-                    qsort(replace, match_cnt, sizeof(Signature *), SortHelper);
+                    qsort(det_ctx->replace, match_cnt, sizeof(Signature *), SortHelper);
                 }
                 /* rewrite match_array to include the new additions, and deduplicate
                  * while at it. */
@@ -828,7 +825,7 @@ static inline uint8_t DetectRulePacketRules(ThreadVars *const tv,
                         continue;
                     }
                     last_sig = *m;
-                    *m++ = (Signature *)replace[x];
+                    *m++ = (Signature *)det_ctx->replace[x];
                 }
                 match_cnt -= skipped;
                 /* prefetch next */

src/detect.h

@@ -1332,6 +1332,9 @@ typedef struct DetectEngineThreadCtx_ {
     /** array of signature pointers we're going to inspect in the detection
      *  loop. */
     Signature **match_array;
+    /** temporary array of signature pointers we're going to inspect in the
+     *   detection loop. */
+    const Signature **replace;
     /** size of the array in items (mem size if * sizeof(Signature *)
      *  Only used during initialization. */
     uint32_t match_array_len;