diff --git a/CHANGES b/CHANGES index 16206ce34a..38eaac19b0 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +3.3.0-dev.188 | 2020-08-24 14:30:43 -0700 + + * GH-710: Check that &expire_func is a function and not hook/event (Jon Siwek, Corelight) + 3.3.0-dev.186 | 2020-08-24 14:28:25 -0700 * Fix a case where PktSrc gets processed twice in one runloop iteration diff --git a/VERSION b/VERSION index afc0f332ed..e18970d8ff 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -3.3.0-dev.186 +3.3.0-dev.188 diff --git a/src/Attr.cc b/src/Attr.cc index 8f6b54a13c..537c04a24f 100644 --- a/src/Attr.cc +++ b/src/Attr.cc @@ -512,10 +512,19 @@ void Attributes::CheckAttr(Attr* a) const auto& expire_func = a->GetExpr(); if ( expire_func->GetType()->Tag() != TYPE_FUNC ) + { Error("&expire_func attribute is not a function"); + break; + } const FuncType* e_ft = expire_func->GetType()->AsFuncType(); + if ( e_ft->Flavor() != FUNC_FLAVOR_FUNCTION ) + { + Error("&expire_func attribute is not a function"); + break; + } + if ( e_ft->Yield()->Tag() != TYPE_INTERVAL ) { Error("&expire_func must yield a value of type interval"); diff --git a/testing/btest/Baseline/language.expire-func-type-check/output b/testing/btest/Baseline/language.expire-func-type-check/output new file mode 100644 index 0000000000..a1beba1f27 --- /dev/null +++ b/testing/btest/Baseline/language.expire-func-type-check/output @@ -0,0 +1,3 @@ +error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.expire-func-type-check/expire-func-type-check.zeek, line 12: &expire_func attribute is not a function (&expire_func=myev) +error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.expire-func-type-check/expire-func-type-check.zeek, line 13: &expire_func attribute is not a function (&expire_func=myhk) +error in /home/jon/pro/zeek/zeek/testing/btest/.tmp/language.expire-func-type-check/expire-func-type-check.zeek, line 14: &expire_func attribute is not a function (&expire_func=foo) diff --git a/testing/btest/language/expire-func-type-check.zeek b/testing/btest/language/expire-func-type-check.zeek new file mode 100644 index 0000000000..a6126806f2 --- /dev/null +++ b/testing/btest/language/expire-func-type-check.zeek @@ -0,0 +1,14 @@ +# @TEST-EXEC-FAIL: zeek -b %INPUT >output 2>&1 +# @TEST-EXEC: TEST_DIFF_CANONIFIER=$SCRIPTS/diff-remove-abspath btest-diff output + +event myev(t: table[string] of count) + { } + +hook myhk(t: table[string] of count) + { } + +global foo = 3; + +global t: table[string] of count &expire_func=myev; +global tt: table[string] of count &expire_func=myhk; +global ttt: table[string] of count &expire_func=foo;