From ef086058776cf97107a72a30c3e819995907f41b Mon Sep 17 00:00:00 2001
From: Christian Kreibich <christian@corelight.com>
Date: Wed, 16 Jun 2021 15:30:56 -0700
Subject: [PATCH] Fix segfault in input framework when reading unset fields

Unset fields could trigger unexpected null pointers in the input
manager. This also adds a warning such fields come up.
---
 src/input/Manager.cc | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/input/Manager.cc b/src/input/Manager.cc
index 2bbf036c8f..e224740eba 100644
--- a/src/input/Manager.cc
+++ b/src/input/Manager.cc
@@ -1073,7 +1073,21 @@ Val* Manager::ValueToIndexVal(const Stream* i, int num_fields, const RecordType
 				}
 			else
 				{
+				// Bail early here if we already have an error. ValueToVal() won't do
+				// anything in that case, and by checking first we know that if
+				// ValueToVal() returns nullptr, there is a new problem.
+				if ( have_error )
+					break;
+
 				auto v = ValueToVal(i, vals[position], type->GetFieldType(j).get(), have_error);
+				if ( ! v )
+					{
+					// Since we're building a (list) value for indexing into
+					// a table, it is for sure an error to miss a value.
+					Warning(i, "Skipping input with missing non-optional value");
+					have_error = true;
+					}
+
 				if ( have_error )
 					break;