diff --git a/CHANGES b/CHANGES index f8ca072f83..4a1c61ccab 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.5-711 | 2018-06-27 19:11:58 -0500 + + * Prevent double-wrapping Broker::Data in published event args (Corelight) + 2.5-710 | 2018-06-26 18:06:22 -0500 * Add memory leak unit test for pattern operations (Corelight) diff --git a/VERSION b/VERSION index ca1bc4e12b..0ddf8676ac 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.5-710 +2.5-711 diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc index 6f5e09e611..5def875ce7 100644 --- a/src/broker/Manager.cc +++ b/src/broker/Manager.cc @@ -815,7 +815,15 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame) return rval; } - auto data_val = make_data_val((*args)[i]); + RecordVal* data_val; + + if ( same_type(got_type, bro_broker::DataVal::ScriptDataType()) ) + { + data_val = (*args)[i]->AsRecordVal(); + Ref(data_val); + } + else + data_val = make_data_val((*args)[i]); if ( ! data_val->Lookup(0) ) { diff --git a/testing/btest/broker/remote_event_any.bro b/testing/btest/broker/remote_event_any.bro index 153056c456..9e5c8ea8de 100644 --- a/testing/btest/broker/remote_event_any.bro +++ b/testing/btest/broker/remote_event_any.bro @@ -69,7 +69,7 @@ const events_to_recv = 5; global handler: event(msg: string, c: count); global auto_handler: event(msg: string, c: count); -global pong: event(msg: string, c: count); +global pong: event(msg: string, c: any); event bro_init() { @@ -101,7 +101,11 @@ event ping(msg: string, n: any) return; } - Broker::publish("bro/event/my_topic", pong, msg, n as count); + if ( (n as count) % 2 == 0 ) + Broker::publish("bro/event/my_topic", pong, msg, n as count); + else + # internals should not wrap n into another Broker::Data record + Broker::publish("bro/event/my_topic", pong, msg, n); } @TEST-END-FILE