Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-09 18:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fix file analyzer memory management.

Browse source 
File analyzers got deleted immediately once the queue with the
corresponding removal operation got drained. That however can happen
while the analyzer is still doing stuff: the queue is drained whenever
any the "special" file analysis events needing immediate attention has
been executed. This fix now only schedules the analyzer for deletion
at that time, but postpones the actual operation until file object
itself is being destroyed.
This commit is contained in:
Robin Sommer 2017-01-28 11:45:49 -08:00
parent 572c9b49fd
commit 3ce6a031d4
3 changed files with 18 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/file_analysis/AnalyzerSet.cc
View file

@ -130,7 +130,10 @@ bool AnalyzerSet::Remove(file_analysis::Tag tag, HashKey* key)
file_mgr->GetComponentName(tag).c_str());
a->Done();
delete a;
// We don't delete the analyze object right here because the remove
// operation may execute when that will still be accessed.
file->DoneWithAnalyzer(a);
return true;
}

8
src/file_analysis/File.cc
View file

@ -107,6 +107,9 @@ File::~File()
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Destroying File object", id.c_str());
Unref(val);
delete file_reassembler;
for ( auto a : done_analyzers )
delete a;
}
void File::UpdateLastActivityTime()
@ -478,6 +481,11 @@ void File::DeliverChunk(const u_char* data, uint64 len, uint64 offset)
EndOfFile();
}
void File::DoneWithAnalyzer(Analyzer* analyzer)
{
done_analyzers.push_back(analyzer);
}
void File::DataIn(const u_char* data, uint64 len, uint64 offset)
{
analyzers.DrainModifications();

6
src/file_analysis/File.h
View file

@ -119,6 +119,11 @@ public:
*/
bool RemoveAnalyzer(file_analysis::Tag tag, RecordVal* args);
/**
* Signal that this analyzer can be deleted once it's safe to do so.
*/
void DoneWithAnalyzer(Analyzer* analyzer);
/**
* Pass in non-sequential data and deliver to attached analyzers.
* @param data pointer to start of a chunk of file data.
@ -287,6 +292,7 @@ protected:
bool postpone_timeout; /**< Whether postponing timeout is requested. */
bool done; /**< If this object is about to be deleted. */
AnalyzerSet analyzers; /**< A set of attached file analyzers. */
std::list<Analyzer *> done_analyzers; /**< Analyzers we're done with, remembered here until they be safely deleted. */
struct BOF_Buffer {
BOF_Buffer() : full(false), size(0) {}