From bc1f2a0a63e5f2380d50cb1ceb80e98369bc3ad6 Mon Sep 17 00:00:00 2001
From: Justin Azoff <justin@bouncybouncy.net>
Date: Sat, 23 Feb 2019 20:52:30 -0500
Subject: [PATCH] Avoid buffering all http headers

Only buffer all http headers if the http_all_headers event is in use.
---
 src/analyzer/protocol/http/HTTP.cc | 1 +
 src/analyzer/protocol/mime/MIME.cc | 8 ++++++--
 src/analyzer/protocol/mime/MIME.h  | 1 +
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/src/analyzer/protocol/http/HTTP.cc b/src/analyzer/protocol/http/HTTP.cc
index 4706286914..e7f0cc41d8 100644
--- a/src/analyzer/protocol/http/HTTP.cc
+++ b/src/analyzer/protocol/http/HTTP.cc
@@ -53,6 +53,7 @@ HTTP_Entity::HTTP_Entity(HTTP_Message *arg_message, MIME_Entity* parent_entity,
 	offset = 0;
 	instance_length = -1; // unspecified
 	send_size = true;
+	want_all_headers = (bool)http_all_headers;
 	}
 
 void HTTP_Entity::EndOfData()
diff --git a/src/analyzer/protocol/mime/MIME.cc b/src/analyzer/protocol/mime/MIME.cc
index 931e155fdf..ea15ce9e8b 100644
--- a/src/analyzer/protocol/mime/MIME.cc
+++ b/src/analyzer/protocol/mime/MIME.cc
@@ -537,6 +537,7 @@ MIME_Entity::MIME_Entity(MIME_Message* output_message, MIME_Entity* parent_entit
 	message = output_message;
 	if ( parent )
 		content_encoding = parent->ContentTransferEncoding();
+	want_all_headers = (bool)mime_all_headers;
 	}
 
 void MIME_Entity::init()
@@ -744,8 +745,11 @@ void MIME_Entity::FinishHeader()
 		{
 		ParseMIMEHeader(h);
 		SubmitHeader(h);
-		headers.push_back(h);
-		}
+		if(want_all_headers)
+			headers.push_back(h);
+		else
+			delete h;
+		} 
 	else
 		delete h;
 	}
diff --git a/src/analyzer/protocol/mime/MIME.h b/src/analyzer/protocol/mime/MIME.h
index 9fcf2ea468..caa5f03cd4 100644
--- a/src/analyzer/protocol/mime/MIME.h
+++ b/src/analyzer/protocol/mime/MIME.h
@@ -173,6 +173,7 @@ protected:
 
 	MIME_Message* message;
 	bool delay_adding_implicit_CRLF;
+	bool want_all_headers;
 };
 
 // The reason I separate MIME_Message as an abstract class is to