Fix invalid memory free when using Log::default_field_name_map

This commit is contained in:
Jon Siwek 2018-09-10 19:06:35 -05:00
parent 4d7b0387ea
commit c89c09fda3
4 changed files with 26 additions and 1 deletions

View file

@ -875,7 +875,7 @@ bool Manager::Write(EnumVal* id, RecordVal* columns)
if ( (val = filter->field_name_map->Lookup(fn, false)) != 0 ) if ( (val = filter->field_name_map->Lookup(fn, false)) != 0 )
{ {
delete [] filter->fields[j]->name; delete [] filter->fields[j]->name;
filter->fields[j]->name = val->AsStringVal()->CheckString(); filter->fields[j]->name = copy_string(val->AsStringVal()->CheckString());
} }
delete fn; delete fn;
} }

View file

@ -0,0 +1,10 @@
#separator \x09
#set_separator ,
#empty_field (empty)
#unset_field -
#path conn
#open 2018-09-11-00-03-40
#fields ts uid src_ip src_port dst_ip dst_port proto service duration orig_bytes resp_bytes conn_state local_orig local_resp missed_bytes history orig_pkts orig_ip_bytes resp_pkts resp_ip_bytes tunnel_parents
#types time string addr port addr port enum string interval count count string bool bool count string count count count count set[string]
1427304960.695733 CHhAvVGS1DHFjwGM9 192.168.1.2 49159 192.168.1.1 20000 tcp - 0.463113 120 0 S0 - - 0 SAD 5 332 0 0 -
#close 2018-09-11-00-03-40

Binary file not shown.

View file

@ -0,0 +1,15 @@
# @TEST-EXEC: bro -b -r $TRACES/auth_change_session_keys.pcap %INPUT
# @TEST-EXEC: btest-diff conn.log
# The other tests of Log::default_field_name_map used to not catch an invalid
# memory free for some reason, but this test did reproduce a crash
# consistently (now fixed).
@load base/protocols/conn
redef Log::default_field_name_map = {
["id.orig_h"] = "src_ip",
["id.orig_p"] = "src_port",
["id.resp_h"] = "dst_ip",
["id.resp_p"] = "dst_port"
};