From 2451bf05d733e90e5daad5c8071feb4c01574785 Mon Sep 17 00:00:00 2001
From: Felipe Zimmerle <fcosta@trustwave.com>
Date: Thu, 17 Sep 2015 19:26:44 -0300
Subject: [PATCH] Using pcre (with JIT) instead of pcrecpp

---
 src/operators/rx.cc |  3 +--
 src/operators/rx.h  |  6 +++++-
 src/utils/regex.cc  | 28 ++++++++++++++--------------
 src/utils/regex.h   |  6 +++++-
 4 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/src/operators/rx.cc b/src/operators/rx.cc
index 50f26dda..710c8e37 100644
--- a/src/operators/rx.cc
+++ b/src/operators/rx.cc
@@ -29,8 +29,7 @@ namespace operators {
 bool Rx::evaluate(Assay *assay, const std::string& input) {
     SMatch match;
 
-    Regex re(MacroExpansion::expand(param, assay));
-    if (regex_search(input, &match, re) && match.size() >= 1) {
+    if (regex_search(input, &match, *m_re) && match.size() >= 1) {
         this->matched.push_back(match.match);
         return true;
     }
diff --git a/src/operators/rx.h b/src/operators/rx.h
index 1f99bc67..03c6491b 100644
--- a/src/operators/rx.h
+++ b/src/operators/rx.h
@@ -36,13 +36,17 @@ class Rx : public Operator {
     /** @ingroup ModSecurity_Operator */
     Rx(std::string op, std::string param, bool negation)
         : Operator(op, param, negation),
-        m_param(param) { }
+        m_param(param) {
+            Regex r(param);
+            m_re = &r;
+        }
 
     bool evaluate(Assay *assay, const std::string &input);
 
     std::list<std::string> matched;
  private:
     std::string m_param;
+    Regex *m_re;
 };
 
 
diff --git a/src/utils/regex.cc b/src/utils/regex.cc
index f0cf1940..5fa60223 100644
--- a/src/utils/regex.cc
+++ b/src/utils/regex.cc
@@ -15,7 +15,7 @@
 
 #include "utils/regex.h"
 
-#include <pcrecpp.h>
+#include <pcre.h>
 #include <sys/socket.h>
 #include <sys/types.h>
 #include <netinet/in.h>
@@ -33,28 +33,28 @@ namespace Utils {
 
 Regex::Regex(const std::string& pattern_)
     : pattern(pattern_) {
+    const char *errptr = NULL;
+    int erroffset;
+
     if (pattern.empty() == true) {
         pattern.assign(".*");
     }
+
+    m_pc = pcre_compile(pattern.c_str(), PCRE_DOTALL|PCRE_MULTILINE, &errptr, &erroffset, NULL);
+    m_pce = pcre_study(m_pc, PCRE_STUDY_JIT_COMPILE, &errptr);
 }
 
 int regex_search(const std::string& s, SMatch *match,
     const Regex& regex) {
-    std::string m;
-    pcrecpp::RE re(regex.pattern,
-        pcrecpp::RE_Options(PCRE_DOTALL|PCRE_MULTILINE));
-
-    /** FIXME: Should be not necessary to call PartialMatch twice here. */
-    match->size_ = re.PartialMatch(s);
-    re.PartialMatch(s, &m);
-    match->match = m;
-
-    return match->size_;
+    int *ovector = 0;
+    int ovecsize = 0;
+    return pcre_exec(regex.m_pc, regex.m_pce, s.c_str(), s.size(), 0, 0, ovector, ovecsize) > 0;
 }
 
-int regex_search(const std::string& s, Regex regex) {
-    pcrecpp::RE re(regex.pattern);
-    return re.PartialMatch(s);
+int regex_search(const std::string& s, const Regex& regex) {
+    int *ovector = 0;
+    int ovecsize = 0;
+    return pcre_exec(regex.m_pc, regex.m_pce, s.c_str(), s.size(), 0, 0, ovector, ovecsize) > 0;
 }
 
 }  // namespace Utils
diff --git a/src/utils/regex.h b/src/utils/regex.h
index 0515116b..cbf7d4e9 100644
--- a/src/utils/regex.h
+++ b/src/utils/regex.h
@@ -16,6 +16,7 @@
 #include <iostream>
 #include <fstream>
 #include <string>
+#include <pcre.h>
 
 #ifndef SRC_UTILS_REGEX_H_
 #define SRC_UTILS_REGEX_H_
@@ -29,6 +30,9 @@ class Regex {
  public:
     explicit Regex(const std::string& pattern_);
     std::string pattern;
+    pcre *m_pc = NULL;
+    pcre_extra *m_pce = NULL;
+
 };
 
 
@@ -44,7 +48,7 @@ class SMatch {
 int regex_search(const std::string& s, SMatch *m,
     const Regex& regex);
 
-int regex_search(const std::string& s, Regex r);
+int regex_search(const std::string& s, const Regex& r);