From c38e9b2ff262f89ff91a83e15011c2a80ae5f354 Mon Sep 17 00:00:00 2001
From: Robin Sommer <robin@corelight.com>
Date: Fri, 20 Sep 2019 07:55:09 +0000
Subject: [PATCH] Fix for CIDs 1402823 and 1394050.

An InterpreterException from clone framing could go uncaught.
---
 src/Frame.h    |  2 +-
 src/Trigger.cc | 16 +++++++++++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/Frame.h b/src/Frame.h
index 433c2ff375..efb1e2c398 100644
--- a/src/Frame.h
+++ b/src/Frame.h
@@ -128,7 +128,7 @@ public:
 	/**
 	 * Performs a deep copy of all the values in the current frame. If
 	 * the frame has a closure the returned frame captures that closure
-	 * by reference.. As such, performing a clone operation does not copy
+	 * by reference. As such, performing a clone operation does not copy
 	 * the values in the closure.
 	 *
 	 * @return a copy of this frame.
diff --git a/src/Trigger.cc b/src/Trigger.cc
index ae6483e3f5..8a9756f6d4 100644
--- a/src/Trigger.cc
+++ b/src/Trigger.cc
@@ -218,7 +218,21 @@ bool Trigger::Eval()
 	// An alternative approach to copying the frame would be to deep-copy
 	// the expression itself, replacing all references to locals with
 	// constants.
-	Frame* f = frame->Clone();
+
+	Frame* f = nullptr;
+
+	try
+		{
+		f = frame->Clone();
+		}
+	catch ( InterpreterException& )
+		{
+		// Frame contains values that couldn't be cloned. It's
+		// already been reported, disable trigger.
+		Disable();
+		return false;
+		}
+
 	f->SetTrigger(this);
 
 	Val* v = nullptr;