Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

input/Manager: fix three use-after-free bugs

Browse source 
The code comment said "ref'd by lookupwithdefault", but the `fields`
variable was not referenced; only `fields_val` was, and its reference
was released earlier.

Same for `idx` and `val` in method CreateTableStream().

Fixes a regression from commit d81bfed45d
This commit is contained in:
Max Kellermann 2020-03-04 21:02:48 +01:00
parent 2286865674
commit 4d39f53ab2
1 changed files with 2 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/input/Manager.cc
View file

@ -467,7 +467,6 @@ bool Manager::CreateEventStream(RecordVal* fval)
for ( unsigned int i = 0; i < fieldsV.size(); i++ ) for ( unsigned int i = 0; i < fieldsV.size(); i++ )
logf[i] = fieldsV[i]; logf[i] = fieldsV[i];
Unref(fields); // ref'd by lookupwithdefault
stream->num_fields = fieldsV.size(); stream->num_fields = fieldsV.size();
stream->fields = fields->Ref()->AsRecordType(); stream->fields = fields->Ref()->AsRecordType();
stream->event = event_registry->Lookup(event->Name()); stream->event = event_registry->Lookup(event->Name());
@ -511,7 +510,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
Val* val_val = fval->Lookup("val", true); Val* val_val = fval->Lookup("val", true);
if ( val_val ) if ( val_val )
{ {
val = val_val->AsType()->AsTypeType()->Type()->AsRecordType(); val = val_val->AsType()->AsTypeType()->Type()->Ref()->AsRecordType();
Unref(val_val); Unref(val_val);
} }
@ -712,7 +711,7 @@ bool Manager::CreateTableStream(RecordVal* fval)
stream->num_val_fields = valfields; stream->num_val_fields = valfields;
stream->tab = dst->AsTableVal(); // ref'd by lookupwithdefault stream->tab = dst->AsTableVal(); // ref'd by lookupwithdefault
stream->rtype = val ? val->AsRecordType() : 0; stream->rtype = val ? val->AsRecordType() : 0;
stream->itype = idx->AsRecordType(); stream->itype = idx->Ref()->AsRecordType();
stream->event = event ? event_registry->Lookup(event->Name()) : 0; stream->event = event ? event_registry->Lookup(event->Name()) : 0;
stream->error_event = error_event ? event_registry->Lookup(error_event->Name()) : nullptr; stream->error_event = error_event ? event_registry->Lookup(error_event->Name()) : nullptr;
stream->currDict = new PDict<InputHash>; stream->currDict = new PDict<InputHash>;