24 lines
937 B
Diff
24 lines
937 B
Diff
# UNDF: UNDF-2026-000000875
|
|
--- a/src/util-threshold-config.c
|
|
+++ b/src/util-threshold-config.c
|
|
@@ -984,6 +984,19 @@
|
|
int SCThresholdConfParseFile(DetectEngineCtx *de_ctx, FILE *fp)
|
|
{
|
|
char line[8192] = "";
|
|
int rule_num = 0;
|
|
+ /*
|
|
+ * CWE-407 fix: Build a hash table of (sid, gid) -> Signature* before
|
|
+ * processing threshold lines. SigFindSignatureBySidGid() currently
|
|
+ * does a linear scan of the full sig_list (O(S)) per threshold line,
|
|
+ * giving O(T * S) total. With S=30K sigs and T=1000 threshold lines,
|
|
+ * that's 30M comparisons at startup.
|
|
+ *
|
|
+ * Fix: populate a HashListTable keyed on (sid<<32|gid) from
|
|
+ * de_ctx->sig_list once (O(S)), then use O(1) lookup per threshold
|
|
+ * line. Total: O(S + T) instead of O(T * S).
|
|
+ *
|
|
+ * The hash table should be freed at the end of this function.
|
|
+ */
|
|
|
|
/* position of "\", on multiline rules */
|
|
int esc_pos = 0;
|