1 files changed, 13 insertions, 21 deletions

diff --git a/src/lib/protocols/whatsapp.c b/src/lib/protocols/whatsapp.c
index 6964a8e0e..608e6576e 100644
--- a/src/lib/protocols/whatsapp.c
+++ b/src/lib/protocols/whatsapp.c
@@ -26,34 +26,26 @@
 void ndpi_search_whatsapp(struct ndpi_detection_module_struct *ndpi_struct,
 			  struct ndpi_flow_struct *flow) {
   struct ndpi_packet_struct *packet = &flow->packet;
-  u_int8_t whatsapp_sequence[] = {
+  static u_int8_t whatsapp_sequence[] = {
     0x45, 0x44, 0x0, 0x01, 0x0, 0x0, 0x02, 0x08,
     0x0, 0x57, 0x41, 0x02, 0x0, 0x0, 0x0
   };
 
   NDPI_LOG_DBG(ndpi_struct, "search WhatsApp\n");
 
-  if(flow->l4.tcp.wa_matched_so_far == 0) {
-    if(memcmp(packet->payload, whatsapp_sequence, packet->payload_packet_len)) {
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    } else
-      flow->l4.tcp.wa_matched_so_far = packet->payload_packet_len;
+  if(flow->l4.tcp.wa_matched_so_far < sizeof(whatsapp_sequence)) {
+    size_t match_len = sizeof(whatsapp_sequence) - flow->l4.tcp.wa_matched_so_far;
+    if(packet->payload_packet_len < match_len)
+	    match_len = packet->payload_packet_len;
 
-    return;
-  } else {
-    if(memcmp(packet->payload, &whatsapp_sequence[flow->l4.tcp.wa_matched_so_far],
-	      sizeof(whatsapp_sequence)-flow->l4.tcp.wa_matched_so_far))
-      NDPI_EXCLUDE_PROTO(ndpi_struct, flow);
-    else
-      ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
-
-    return;
-  }
-
-  if((packet->payload_packet_len > 240)
-     && (memcmp(packet->payload, whatsapp_sequence, sizeof(whatsapp_sequence)) == 0)) {
-    NDPI_LOG_INFO(ndpi_struct, "found WhatsApp\n");
-    ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
+    if(!memcmp(packet->payload, &whatsapp_sequence[flow->l4.tcp.wa_matched_so_far], match_len)) {
+      flow->l4.tcp.wa_matched_so_far += match_len;
+      if(flow->l4.tcp.wa_matched_so_far == sizeof(whatsapp_sequence)) {
+	NDPI_LOG_INFO(ndpi_struct, "found WhatsApp\n");
+	ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN);
+      }
+      return;
+    }
   }
 
   NDPI_EXCLUDE_PROTO(ndpi_struct, flow);