From 586522e1e99198826d81ec33381b6333371dfa80 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <contact@catenacyber.fr>
Date: Thu, 30 Sep 2021 15:23:15 +0200
Subject: [PATCH] pcre: local match data for pcrexform

---
 src/detect-transform-pcrexform.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/src/detect-transform-pcrexform.c b/src/detect-transform-pcrexform.c
index 490404db0758..5f64b40efb98 100644
--- a/src/detect-transform-pcrexform.c
+++ b/src/detect-transform-pcrexform.c
@@ -32,7 +32,6 @@
 
 typedef struct DetectTransformPcrexformData {
     pcre2_code *regex;
-    pcre2_match_data *match_data;
 } DetectTransformPcrexformData;
 
 static int DetectTransformPcrexformSetup (DetectEngineCtx *, Signature *, const char *);
@@ -65,7 +64,6 @@ static void DetectTransformPcrexformFree(DetectEngineCtx *de_ctx, void *ptr)
     if (ptr != NULL) {
         DetectTransformPcrexformData *pxd = (DetectTransformPcrexformData *) ptr;
         pcre2_code_free(pxd->regex);
-        pcre2_match_data_free(pxd->match_data);
         SCFree(pxd);
     }
 }
@@ -116,7 +114,6 @@ static int DetectTransformPcrexformSetup (DetectEngineCtx *de_ctx, Signature *s,
         DetectTransformPcrexformFree(de_ctx, pxd);
         SCReturnInt(-1);
     }
-    pxd->match_data = pcre2_match_data_create_from_pattern(pxd->regex, NULL);
 
     int r = DetectSignatureAddTransform(s, DETECT_TRANSFORM_PCREXFORM, pxd);
     if (r != 0) {
@@ -132,18 +129,20 @@ static void DetectTransformPcrexform(InspectionBuffer *buffer, void *options)
     const uint32_t input_len = buffer->inspect_len;
     DetectTransformPcrexformData *pxd = options;
 
-    int ret = pcre2_match(pxd->regex, (PCRE2_SPTR8)input, input_len, 0, 0, pxd->match_data, NULL);
+    pcre2_match_data *match = pcre2_match_data_create_from_pattern(pxd->regex, NULL);
+    int ret = pcre2_match(pxd->regex, (PCRE2_SPTR8)input, input_len, 0, 0, match, NULL);
 
     if (ret > 0) {
         const char *str;
         PCRE2_SIZE caplen;
-        ret = pcre2_substring_get_bynumber(pxd->match_data, 0, (PCRE2_UCHAR8 **)&str, &caplen);
+        ret = pcre2_substring_get_bynumber(match, 0, (PCRE2_UCHAR8 **)&str, &caplen);
 
         if (ret >= 0) {
             InspectionBufferCopy(buffer, (uint8_t *)str, (uint32_t)caplen);
             pcre2_substring_free((PCRE2_UCHAR8 *)str);
         }
     }
+    pcre2_match_data_free(match);
 }
 
 #ifdef UNITTESTS