Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 06:38:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

GH-286: Check for record type mismatch in ternary operator

Browse source 
Fixes GH-286
This commit is contained in:
Jon Siwek 2019-02-25 12:55:03 -06:00
parent a342090f18
commit 74c225c7cb
5 changed files with 41 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

26
scripts/base/frameworks/intel/main.bro
View file

@ -268,16 +268,21 @@ function expire_string_data(data: table[string, Type] of MetaDataTable, idx: any
# Function to check for intelligence hits.
function find(s: Seen): bool
{
local ds = have_full_data ? data_store : min_data_store;
if ( s?$host )
{
return ((s$host in ds$host_data) ||
(|matching_subnets(addr_to_subnet(s$host), ds$subnet_data)| > 0));
if ( have_full_data )
return ((s$host in data_store$host_data) ||
(|matching_subnets(addr_to_subnet(s$host), data_store$subnet_data)| > 0));
else
return ((s$host in min_data_store$host_data) ||
(|matching_subnets(addr_to_subnet(s$host), min_data_store$subnet_data)| > 0));
}
else
{
return ([to_lower(s$indicator), s$indicator_type] in ds$string_data);
if ( have_full_data )
return ([to_lower(s$indicator), s$indicator_type] in data_store$string_data);
else
return ([to_lower(s$indicator), s$indicator_type] in min_data_store$string_data);
}
}
@ -499,16 +504,17 @@ function insert(item: Item)
# Function to check whether an item is present.
function item_exists(item: Item): bool
{
local ds = have_full_data ? data_store : min_data_store;
switch ( item$indicator_type )
{
case ADDR:
return to_addr(item$indicator) in ds$host_data;
return have_full_data ? to_addr(item$indicator) in data_store$host_data :
to_addr(item$indicator) in min_data_store$host_data;
case SUBNET:
return to_subnet(item$indicator) in ds$subnet_data;
return have_full_data ? to_subnet(item$indicator) in data_store$subnet_data :
to_subnet(item$indicator) in min_data_store$subnet_data;
default:
return [item$indicator, item$indicator_type] in ds$string_data;
return have_full_data ? [item$indicator, item$indicator_type] in data_store$string_data :
[item$indicator, item$indicator_type] in min_data_store$string_data;
}
}