From 4c42998feb962b3eb43b106597a53fcb6dc9cb61 Mon Sep 17 00:00:00 2001
From: Philippe Antoine <pantoine@oisf.net>
Date: Mon, 11 May 2026 20:47:46 +0200
Subject: [PATCH] detect/engine: helper to know if a transform happens in-place

---
 rust/sys/src/sys.rs                | 3 +++
 src/detect-engine-inspect-buffer.c | 7 +++++++
 src/detect-engine-inspect-buffer.h | 1 +
 3 files changed, 11 insertions(+)

diff --git a/rust/sys/src/sys.rs b/rust/sys/src/sys.rs
index daa3cf75b1..aecaf19090 100644
--- a/rust/sys/src/sys.rs
+++ b/rust/sys/src/sys.rs
@@ -720,6 +720,9 @@ extern "C" {
         det_ctx: *mut DetectEngineThreadCtx, list_id: ::std::os::raw::c_int,
     ) -> *mut InspectionBuffer;
 }
+extern "C" {
+    pub fn SCInspectionBufferInPlace(buffer: *const InspectionBuffer) -> bool;
+}
 #[repr(C)]
 #[derive(Debug, Copy, Clone)]
 pub struct SigMatchCtx_ {
diff --git a/src/detect-engine-inspect-buffer.c b/src/detect-engine-inspect-buffer.c
index 2f6e25dbd3..512c61f5d1 100644
--- a/src/detect-engine-inspect-buffer.c
+++ b/src/detect-engine-inspect-buffer.c
@@ -255,3 +255,10 @@ void InspectionBufferCopy(InspectionBuffer *buffer, uint8_t *buf, uint32_t buf_l
         buffer->initialized = true;
     }
 }
+
+// Returns wether the inspection buffer will make the transform run in-place
+// Especially useful for transforms that produces an output longer than the input
+bool SCInspectionBufferInPlace(const InspectionBuffer *buffer)
+{
+    return buffer->inspect == buffer->buf;
+}
diff --git a/src/detect-engine-inspect-buffer.h b/src/detect-engine-inspect-buffer.h
index 5fbc29bf96..0e8c7dd443 100644
--- a/src/detect-engine-inspect-buffer.h
+++ b/src/detect-engine-inspect-buffer.h
@@ -72,5 +72,6 @@ void InspectionBufferSetupMulti(DetectEngineThreadCtx *det_ctx, InspectionBuffer
         const DetectEngineTransforms *transforms, const uint8_t *data, const uint32_t data_len);
 InspectionBuffer *InspectionBufferMultipleForListGet(
         DetectEngineThreadCtx *det_ctx, const int list_id, uint32_t local_id);
+bool SCInspectionBufferInPlace(const InspectionBuffer *buffer);
 
 #endif /* SURICATA_DETECT_ENGINE_INSPECT_BUFFER_H */