Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Make 0 be a valid packet source timestamp

Browse source 
For fuzzed/damaged/corrupted pcaps, a timestamp of 0 could lead to an
infinite loop in Bro as it interprets that as meaning the packet source
is not ready yet.
This commit is contained in:
Jon Siwek 2018-06-04 13:52:46 -05:00
parent 791b24d232
commit 19b893a5bc
4 changed files with 9 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -1,4 +1,8 @@
2.5-642 | 2018-06-04 13:52:46 -0500
* Make 0 be a valid packet source timestamp (Corelight)
2.5-641 | 2018-06-04 09:18:59 -0700 2.5-641 | 2018-06-04 09:18:59 -0700
* Add Broker::publish_and_relay BIF * Add Broker::publish_and_relay BIF

2
VERSION
View file

@ -1 +1 @@
2.5-641 2.5-642

4
src/Serializer.cc
View file

@ -1017,7 +1017,7 @@ double EventPlayer::NextTimestamp(double* local_network_time)
return ne_time; return ne_time;
if ( ! io ) if ( ! io )
return 0; return -1;
// Read next event if we don't have one waiting. // Read next event if we don't have one waiting.
if ( ! ne_time ) if ( ! ne_time )
@ -1028,7 +1028,7 @@ double EventPlayer::NextTimestamp(double* local_network_time)
} }
if ( ! ne_time ) if ( ! ne_time )
return 0; return -1;
if ( ! network_time ) if ( ! network_time )
{ {

4
src/iosource/Manager.cc
View file

@ -81,7 +81,7 @@ IOSource* Manager::FindSoonest(double* ts)
all_idle = false; all_idle = false;
double local_network_time = 0; double local_network_time = 0;
double ts = (*i)->src->NextTimestamp(&local_network_time); double ts = (*i)->src->NextTimestamp(&local_network_time);
if ( ts > 0 && ts < soonest_ts ) if ( ts >= 0 && ts < soonest_ts )
{ {
soonest_ts = ts; soonest_ts = ts;
soonest_src = (*i)->src; soonest_src = (*i)->src;
@ -162,7 +162,7 @@ IOSource* Manager::FindSoonest(double* ts)
{ {
double local_network_time = 0; double local_network_time = 0;
double ts = src->src->NextTimestamp(&local_network_time); double ts = src->src->NextTimestamp(&local_network_time);
if ( ts > 0.0 && ts < soonest_ts ) if ( ts >= 0.0 && ts < soonest_ts )
{ {
soonest_ts = ts; soonest_ts = ts;
soonest_src = src->src; soonest_src = src->src;