From 8fc83f5feeb1fb9f68c8fe1fa1f76ddbca7536c3 Mon Sep 17 00:00:00 2001 From: Justin Azoff Date: Sun, 24 Feb 2019 11:17:33 -0500 Subject: [PATCH] Remove redundant buffering in contentline The contentline analyzer has two code paths that buffer data: * right at the top of DeliverStream * later in DoDeliverOnce However, contentline can be in plain delivery mode, and if so, the buffer resize in DeliverStream does not need to be done just because DeliverStream was passed an 8K data chunk. This was causing contentline to resize it's buffer to fit chunks of HTTP response data. Additionally, the buffer was sized to be 3/2 of the chunk, so an 8K chunk would result in a 12K allocation. --- src/analyzer/protocol/tcp/ContentLine.cc | 13 ------------- 1 file changed, 13 deletions(-) diff --git a/src/analyzer/protocol/tcp/ContentLine.cc b/src/analyzer/protocol/tcp/ContentLine.cc index 7fc8085246..db1ce7c16e 100644 --- a/src/analyzer/protocol/tcp/ContentLine.cc +++ b/src/analyzer/protocol/tcp/ContentLine.cc @@ -92,19 +92,6 @@ void ContentLine_Analyzer::DeliverStream(int len, const u_char* data, return; } - if ( buf && len + offset >= buf_len ) - { // Make sure we have enough room to accommodate the new stuff. - int old_buf_len = buf_len; - buf_len = ((offset + len) * 3) / 2 + 1; - - u_char* tmp = new u_char[buf_len]; - for ( int i = 0; i < old_buf_len; ++i ) - tmp[i] = buf[i]; - - delete [] buf; - buf = tmp; - } - DoDeliver(len, data); seq += len;