Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Make "in" keyword work with binary data.

Browse source 
This switches in from using strstr to use strnstr (implementation from
FreeBSD on systems which do not bring their own implementation).

It is especially likely that users come accross this when using the
DATA_EVENT analyzer with files that contain binary data - the test uses
exactly this case.
This commit is contained in:
Johanna Amann 2017-09-18 11:38:14 -07:00
parent 6ffa99d67e
commit a4d25c8828
4 changed files with 25 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/Expr.cc
View file

@ -4351,9 +4351,8 @@ Val* InExpr::Fold(Val* v1, Val* v2) const
const BroString* s1 = v1->AsString();
const BroString* s2 = v2->AsString();
// Could do better here - either roll our own, to deal with
// NULs, and/or Boyer-Moore if done repeatedly.
return new Val(strstr(s2->CheckString(), s1->CheckString()) != 0, TYPE_BOOL);
// Could do better here e.g. Boyer-Moore if done repeatedly.
return new Val(strstr_n(s2->Len(), s2->Bytes(), s1->Len(), reinterpret_cast<const unsigned char*>(s1->CheckString())) != -1, TYPE_BOOL);
}
if ( v1->Type()->Tag() == TYPE_ADDR &&

0
testing/btest/Baseline/scripts.base.files.data_event.basic/.stderr Normal file
View file

3
testing/btest/Baseline/scripts.base.files.data_event.basic/.stdout Normal file
View file

@ -0,0 +1,3 @@
Found
Found
Found

20
testing/btest/scripts/base/files/data_event/basic.bro Normal file
View file

@ -0,0 +1,20 @@
# Just a very basic test to check if ANALYZER_DATA_EVENT works.
# Also check if "in" works with binary data.
# @TEST-EXEC: bro -r $TRACES/pe/pe.trace %INPUT
# @TEST-EXEC: btest-diff .stdout
# @TEST-EXEC: btest-diff .stderr
event stream_data(f: fa_file, data: string)
{
if ( "Windows" in data )
{
print "Found";
}
}
event file_new (f: fa_file)
{
Files::add_analyzer(f, Files::ANALYZER_DATA_EVENT,
[$stream_event=stream_data]);
}