Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-04 07:38:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Prevent double-wrapping Broker::Data in published event args

Browse source 
In the following example, the republication of "arg" would result in
literally sending it as a Broker::Data record instead of the broker data
that it was already wrapping.

Sender:

    Broker::publish("topic", my_event, "hello")

Receiver:

    event my_event(arg: any)
        {
        Broker::publish("topic", my_event, arg)
        }
This commit is contained in:
Jon Siwek 2018-06-27 19:11:58 -05:00
parent e33a3a9c02
commit 06e7f18a32
4 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.5-711 | 2018-06-27 19:11:58 -0500
* Prevent double-wrapping Broker::Data in published event args (Corelight)
2.5-710 | 2018-06-26 18:06:22 -0500 2.5-710 | 2018-06-26 18:06:22 -0500
* Add memory leak unit test for pattern operations (Corelight) * Add memory leak unit test for pattern operations (Corelight)

2
VERSION
View file

@ -1 +1 @@
2.5-710 2.5-711

10
src/broker/Manager.cc
View file

@ -815,7 +815,15 @@ RecordVal* Manager::MakeEvent(val_list* args, Frame* frame)
return rval; return rval;
} }
auto data_val = make_data_val((*args)[i]); RecordVal* data_val;
if ( same_type(got_type, bro_broker::DataVal::ScriptDataType()) )
{
data_val = (*args)[i]->AsRecordVal();
Ref(data_val);
}
else
data_val = make_data_val((*args)[i]);
if ( ! data_val->Lookup(0) ) if ( ! data_val->Lookup(0) )
{ {

8
testing/btest/broker/remote_event_any.bro
View file

@ -69,7 +69,7 @@ const events_to_recv = 5;
global handler: event(msg: string, c: count); global handler: event(msg: string, c: count);
global auto_handler: event(msg: string, c: count); global auto_handler: event(msg: string, c: count);
global pong: event(msg: string, c: count); global pong: event(msg: string, c: any);
event bro_init() event bro_init()
{ {
@ -101,7 +101,11 @@ event ping(msg: string, n: any)
return; return;
} }
Broker::publish("bro/event/my_topic", pong, msg, n as count); if ( (n as count) % 2 == 0 )
Broker::publish("bro/event/my_topic", pong, msg, n as count);
else
# internals should not wrap n into another Broker::Data record
Broker::publish("bro/event/my_topic", pong, msg, n);
} }
@TEST-END-FILE @TEST-END-FILE