Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-05 16:18:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix using clear_table() within an &expire_func

Browse source 
This previously crashed since clear_table()/TableVal::RemoveAll() left
behind a stale iterator to the old table causing a heap-use-after-free
when resuming table expiry iteration in TableVal::DoExpire().
This commit is contained in:
Jon Siwek 2021-04-26 22:45:14 -07:00
parent 76483a9efa
commit d51bd4bc46
3 changed files with 35 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/Val.cc
View file

@ -1459,6 +1459,8 @@ TableVal::~TableVal()
void TableVal::RemoveAll()
{
delete expire_iterator;
expire_iterator = nullptr;
// Here we take the brute force approach.
delete table_val;
table_val = new PDict<TableEntryVal>;
@ -2575,6 +2577,10 @@ void TableVal::DoExpire(double t)
if ( ! v )
{ // user-provided function deleted it
if ( ! expire_iterator )
// Entire table got dropped (e.g. clear_table() / RemoveAll())
break;
continue;
}
@ -2613,7 +2619,7 @@ void TableVal::DoExpire(double t)
if ( modified )
Modified();
if ( (*expire_iterator) == table_val->end_robust() )
if ( ! expire_iterator || (*expire_iterator) == table_val->end_robust() )
{
delete expire_iterator;
expire_iterator = nullptr;