Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-03 23:28:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

BIT-1240: Fix MIME entity file data/gap ordering.

Browse source 
MIME entities buffered data and passed it along to protocol analyzers in
discrete amounts, but a gap is always passed along right away, so the
ordering of these "events" can cause incorrect file analysis.  The
change here is to never leave any MIME data buffered -- it should now be
passed along line by line as it is seen, but may still temporarily make
use of a buffer allocated by the analyzer as it works on decoding
content.
This commit is contained in:
Jon Siwek 2014-09-08 18:04:03 -05:00
parent ff33789f6a
commit 7a46a70b77
8 changed files with 2422 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

2
src/file_analysis/File.cc
View file

@ -437,7 +437,7 @@ void File::EndOfFile()
void File::Gap(uint64 offset, uint64 len)
{
DBG_LOG(DBG_FILE_ANALYSIS, "[%s] Gap of size %" PRIu64 " at offset %" PRIu64,
id.c_str(), offset, len);
id.c_str(), len, offset);
analyzers.DrainModifications();