diff --git a/CHANGES b/CHANGES index 9110f26af0..7253b651d3 100644 --- a/CHANGES +++ b/CHANGES @@ -1,4 +1,8 @@ +2.6-336 | 2019-05-24 10:23:20 -0700 + + * GH-378: check validity of missing 'val' field in Input::add_table (Jon Siwek, Corelight) + 2.6-335 | 2019-05-24 08:58:59 -0700 * Fix memory leak when no protocol_violation event handler exists (Jon Siwek, Corelight) diff --git a/VERSION b/VERSION index 7fd574fa3b..fa6a9a9132 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -2.6-335 +2.6-336 diff --git a/src/input/Manager.cc b/src/input/Manager.cc index 002e8cded9..bcd3e84bf3 100644 --- a/src/input/Manager.cc +++ b/src/input/Manager.cc @@ -547,6 +547,7 @@ bool Manager::CreateTableStream(RecordVal* fval) Val *want_record = fval->Lookup("want_record", true); + if ( val ) { const BroType* table_yield = dst->Type()->AsTableType()->YieldType(); const BroType* compare_type = val; @@ -565,6 +566,17 @@ bool Manager::CreateTableStream(RecordVal* fval) return false; } } + else + { + if ( ! dst->Type()->IsSet() ) + { + reporter->Error("Input stream %s: 'destination' field is a table," + " but 'val' field is not provided" + " (did you mean to use a set instead of a table?)", + stream_name.c_str()); + return false; + } + } Val* event_val = fval->Lookup("ev", true); Func* event = event_val ? event_val->AsFunc() : 0; diff --git a/testing/btest/Baseline/scripts.base.frameworks.input.errors/.stderr b/testing/btest/Baseline/scripts.base.frameworks.input.errors/.stderr index 238c9a1495..ec83be310b 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.input.errors/.stderr +++ b/testing/btest/Baseline/scripts.base.frameworks.input.errors/.stderr @@ -38,4 +38,5 @@ error: Input stream error2: Error event's first attribute must be of type Input: error: Input stream error3: Error event's first attribute must be of type Input::EventDescription error: Input stream error4: Error event's second attribute must be of type string error: Input stream error5: Error event's third attribute must be of type Reporter::Level +error: Input stream error6: 'destination' field is a table, but 'val' field is not provided (did you mean to use a set instead of a table?) received termination signal diff --git a/testing/btest/scripts/base/frameworks/input/errors.zeek b/testing/btest/scripts/base/frameworks/input/errors.zeek index 4c9c6f8ec2..0bd80f70e3 100644 --- a/testing/btest/scripts/base/frameworks/input/errors.zeek +++ b/testing/btest/scripts/base/frameworks/input/errors.zeek @@ -188,5 +188,7 @@ event zeek_init() Input::add_event([$source="input.log", $name="error4", $fields=Val, $ev=event11, $want_record=T, $error_ev=errorhandler4]); Input::add_event([$source="input.log", $name="error5", $fields=Val, $ev=event11, $want_record=T, $error_ev=errorhandler5]); + Input::add_table([$source="input.log", $name="error6", $idx=Idx, $destination=val_table]); + schedule 3secs { kill_me() }; }