Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-07 00:58:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

logging/Ascii: Fix abort() for non-existing postrotation functions

Browse source 
When looking up the postprocessor function from shadow files, id::find_func()
would abort() if the function wasn't available instead of falling back
to the default postprocessor.

Fix by using id::find() and checking the type explicitly and also adding a
strict type check while at it.

This issue was tickled by loading the json-streaming-logs package,
Zeek creating shadow files containing its custom postprocessor function,
then restarting Zeek without the package loaded.

Closes #4562
This commit is contained in:
Arne Welzel 2025-06-10 20:05:17 +02:00
parent 99155f6ec6
commit 45f5a4c1b8
4 changed files with 44 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

7
src/logging/writers/ascii/Ascii.cc
View file

@ -749,10 +749,9 @@ void Ascii::RotateLeftoverLogs() {
auto ppf = default_ppf;
if ( ! ll.post_proc_func.empty() ) {
auto func = id::find_func(ll.post_proc_func.data());
if ( func )
ppf = std::move(func);
const auto& id = id::find(ll.post_proc_func.data());
if ( id && id->GetVal() && same_type(id->GetVal()->GetType(), default_ppf->GetType()) )
ppf = id->GetVal()->AsFuncVal()->AsFuncPtr();
else
reporter->Warning(
"Could not postprocess log '%s' with intended "