41 static void DetectTransformPcrexform(
51 "modify buffer via PCRE before inspection";
54 DetectTransformPcrexform;
56 DetectTransformPcrexformFree;
58 DetectTransformPcrexformSetup;
69 pcre2_match_context_free(pxd->
context);
70 pcre2_code_free(pxd->
regex);
95 pxd->
context = pcre2_match_context_create(NULL);
104 pxd->
regex = pcre2_compile((PCRE2_SPTR8)regexstr, PCRE2_ZERO_TERMINATED, 0, &en, &eo, NULL);
105 if (pxd->
regex == NULL) {
106 PCRE2_UCHAR buffer[256];
107 pcre2_get_error_message(en, buffer,
sizeof(buffer));
108 SCLogError(
"pcre2 compile of \"%s\" failed at "
110 regexstr, (
int)eo, buffer);
111 pcre2_match_context_free(pxd->
context);
117 if (pcre2_pattern_info(pxd->
regex, PCRE2_INFO_CAPTURECOUNT, &nb) < 0) {
118 SCLogError(
"pcrexform failed getting info about capturecount");
119 DetectTransformPcrexformFree(
de_ctx, pxd);
123 SCLogError(
"pcrexform needs exactly one substring capture, found %" PRIu32, nb);
124 DetectTransformPcrexformFree(
de_ctx, pxd);
130 DetectTransformPcrexformFree(
de_ctx, pxd);
136 static void DetectTransformPcrexform(
139 const char *input = (
const char *)buffer->
inspect;
143 pcre2_match_data *match = pcre2_match_data_create_from_pattern(pxd->
regex, NULL);
144 int ret = pcre2_match(pxd->
regex, (PCRE2_SPTR8)input, input_len, 0, 0, match, pxd->
context);
149 ret = pcre2_substring_get_bynumber(match, 1, (PCRE2_UCHAR8 **)&
str, &caplen);
153 pcre2_substring_free((PCRE2_UCHAR8 *)
str);
156 pcre2_match_data_free(match);