From 4a15328ba9563f7b0b302a6d1748fbb128917cc4 Mon Sep 17 00:00:00 2001
From: Arne Welzel <arne.welzel@corelight.com>
Date: Mon, 29 Sep 2025 15:09:55 +0200
Subject: [PATCH] Conn: Lazily initialize weird_state when needed

A std::unordered_map takes 56 bytes on my system. Switch to a unique_ptr
an initialize weird_state lazily. That saves ~48 bytes per connection.
Particularly for scan or non-weird traffic, this should allow some
memory savings.
---
 src/Conn.cc | 7 ++++++-
 src/Conn.h  | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/Conn.cc b/src/Conn.cc
index d54b9c851e..6d6a2cece7 100644
--- a/src/Conn.cc
+++ b/src/Conn.cc
@@ -4,6 +4,7 @@
 
 #include <binpac.h>
 #include <cctype>
+#include <memory>
 
 #include "zeek/Desc.h"
 #include "zeek/ID.h"
@@ -12,6 +13,7 @@
 #include "zeek/RunState.h"
 #include "zeek/Timer.h"
 #include "zeek/TunnelEncapsulation.h"
+#include "zeek/WeirdState.h"
 #include "zeek/analyzer/Analyzer.h"
 #include "zeek/analyzer/Manager.h"
 #include "zeek/analyzer/protocol/pia/PIA.h"
@@ -399,7 +401,10 @@ void Connection::CheckFlowLabel(bool is_orig, uint32_t flow_label) {
 }
 
 bool Connection::PermitWeird(const char* name, uint64_t threshold, uint64_t rate, double duration) {
-    return detail::PermitWeird(weird_state, name, threshold, rate, duration);
+    if ( ! weird_state )
+        weird_state = std::make_unique<detail::WeirdStateMap>();
+
+    return detail::PermitWeird(*weird_state, name, threshold, rate, duration);
 }
 
 } // namespace zeek
diff --git a/src/Conn.h b/src/Conn.h
index 3460aa31d7..01d107faaf 100644
--- a/src/Conn.h
+++ b/src/Conn.h
@@ -220,7 +220,7 @@ private:
     analyzer::pia::PIA* primary_PIA;
 
     UID uid; // Globally unique connection ID.
-    detail::WeirdStateMap weird_state;
+    std::unique_ptr<detail::WeirdStateMap> weird_state;
 
     // Count number of connections.
     static uint64_t total_connections;