Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Skip negative integers in input framework where not type-permissible

Browse source 
Script-layer counts, when provided as negative integers in an input
file, got cast to unsigned values because strtoull() does not complain
about negative values. For example, input string "-1" would lead to
value 18446744073709551615 (an all-ones 64-bit int) on x86_64. This is
more likely to be an error than an intent to get very large,
platform-dependent values, so these input lines are now skipped with
according messaging in the reporter.log/stderr.

This also affected ports: -1/tcp got cast to unsigned and only thrown
out because PortVal rejects values > 65535, mapping them to 0. We now
skip such inputs as well.

Updates existing input framework tests to capture the new behavior.
This commit is contained in:
Christian Kreibich 2021-01-28 22:42:39 -08:00
parent d845f01b27
commit 38d6b6a98b
7 changed files with 25 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/scripts.base.frameworks.input.port-embedded/zeek..stderr
View file

@ -1,3 +1,5 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
warning: ../input.log/Input::READER_ASCII: Port '50/trash' contained unknown protocol 'trash'
warning: ../input.log/Input::READER_ASCII: Number '-1' cannot be negative
warning: ../input.log/Input::READER_ASCII: Could not convert line '1.2.3.8 -1/tcp' of ../input.log to Val. Ignoring line.
received termination signal