Fix crash when modifying a table from within its &expire_func

CHANGES

@@ -1,4 +1,8 @@
 
+2.6-beta2-25 | 2018-10-12 08:33:32 -0400
+
+  * Fix crash when modifying a table from within its &expire_func (Jon Siwek, Corelight)
+
 2.6-beta2-24 | 2018-10-05 14:24:34 -0500
 
   * GH-184: add `bro-config --build_type`, outputs CMake build type (Jon Siwek, Corelight)

VERSION

@@ -1 +1 @@
-2.6-beta2-24
+2.6-beta2-25

src/Val.cc

@@ -2361,8 +2361,6 @@ void TableVal::DoExpire(double t)
 
 		else if ( v->ExpireAccessTime() + timeout < t )
 			{
-			Val* val = v->Value();
-
 			if ( expire_func )
 				{
 				Val* idx = RecoverIndex(k);
@@ -2403,8 +2401,8 @@ void TableVal::DoExpire(double t)
 					new StateAccess(OP_EXPIRE, this, k));
 
 			tbl->RemoveEntry(k);
+			Unref(v->Value());
 			delete v;
-			Unref(val);
 			Modified();
 			}
 

testing/btest/Baseline/language.expire_func_mod/out

@@ -0,0 +1,10 @@
+starting: ashish, 1
+inside table_expire_func: ashish, 2
+inside table_expire_func: ashish, 3
+inside table_expire_func: ashish, 4
+inside table_expire_func: ashish, 5
+inside table_expire_func: ashish, 6
+inside table_expire_func: ashish, 7
+inside table_expire_func: ashish, 8
+inside table_expire_func: ashish, 9
+inside table_expire_func: ashish, 10

testing/btest/language/expire_func_mod.bro

@@ -0,0 +1,41 @@
+# @TEST-EXEC: bro -b %INPUT >out
+# @TEST-EXEC: btest-diff out
+
+module Test;
+
+redef exit_only_after_terminate = T;
+redef table_expire_interval = .1 secs ;
+
+export {
+	global table_expire_func: function(t: table[string] of count,
+	                                   s: string): interval;
+
+	global t: table[string] of count
+		&write_expire=0 secs
+		&expire_func=table_expire_func;
+}
+
+event die()
+	{
+	terminate();
+	}
+
+function table_expire_func(t: table[string] of count, s: string): interval
+	{
+	t[s] += 1 ;
+
+	print fmt("inside table_expire_func: %s, %s", s, t[s]);
+
+	if ( t[s] < 10 )
+		return .1 secs ;
+
+	schedule .1sec { die() };
+	return 0 secs;
+	}
+
+event bro_init()
+	{
+	local s="ashish";
+	t[s] = 1 ;
+	print fmt("starting: %s, %s", s, t[s]);
+	}