mirror of
https://github.com/zeek/zeek.git
synced 2025-10-09 01:58:20 +00:00
file_analysis: Implement AnalyzerViolation() for file_analysis/Analyzer
Add a test parsing a malformed PE file showing that analyzer_violation_info is raised with the fa_file object set. It could be interesting to pass through an optional connection if one exists, but access is provided through f$conns, too.
This commit is contained in:
parent
bc8fd5a4c6
commit
d5cd023dff
10 changed files with 145 additions and 6 deletions
|
@ -30,6 +30,7 @@ bool PE::DeliverStream(const u_char* data, uint64_t len)
|
|||
}
|
||||
catch ( const binpac::Exception& e )
|
||||
{
|
||||
AnalyzerViolation(util::fmt("Binpac exception: %s", e.c_msg()));
|
||||
return false;
|
||||
}
|
||||
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue