Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Fix potential segfaults in VectorVal Insert/Remove methods

Browse source 
The existence/hole check for managed types was needed to prevent
accessing a nil-optional value.
This commit is contained in:
Jon Siwek 2021-04-19 19:29:37 -07:00
parent 819fc1aac0
commit fd5cdbbe50
3 changed files with 22 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/Val.cc
View file

@ -3390,8 +3390,11 @@ bool VectorVal::Insert(unsigned int index, ValPtr element)
types_it = std::next(yield_types->begin(), index); types_it = std::next(yield_types->begin(), index);
} }
else if ( managed_yield ) else if ( managed_yield )
{
if ( *it )
ZVal::DeleteManagedType(**it); ZVal::DeleteManagedType(**it);
} }
}
else else
{ {
it = vector_val->end(); it = vector_val->end();
@ -3446,7 +3449,10 @@ bool VectorVal::Remove(unsigned int index)
} }
else if ( managed_yield ) else if ( managed_yield )
{
if ( *it )
ZVal::DeleteManagedType(**it); ZVal::DeleteManagedType(**it);
}
vector_val->erase(it); vector_val->erase(it);

2
testing/btest/Baseline/language.vector/out
View file

@ -76,3 +76,5 @@ slicing assignment shrink (PASS)
? operator (PASS) ? operator (PASS)
copy of a vector with holes (PASS) copy of a vector with holes (PASS)
copy of a vector with trailing holes, [0, 2, 3, 77, , ], [0, 2, 3, 77, , ] copy of a vector with trailing holes, [0, 2, 3, 77, , ], [0, 2, 3, 77, , ]
hole in vector of managed types, 5, [[a=T], [a=T], , , [a=T]]
hole in vector of managed types after replacing slice, 3, [[a=T], [a=T], ]

12
testing/btest/language/vector.zeek
View file

@ -10,6 +10,11 @@ function test_case(msg: string, expect: bool)
# Note: only global vectors can be initialized with curly braces # Note: only global vectors can be initialized with curly braces
global vg1: vector of string = { "curly", "braces" }; global vg1: vector of string = { "curly", "braces" };
type R: record {
a: bool &default=T;
};
event zeek_init() event zeek_init()
{ {
local v1: vector of string = vector( "test", "example" ); local v1: vector of string = vector( "test", "example" );
@ -205,4 +210,11 @@ event zeek_init()
v5[6:] = vector(); v5[6:] = vector();
local v20 = copy(v5); local v20 = copy(v5);
print "copy of a vector with trailing holes", v5, v20; print "copy of a vector with trailing holes", v5, v20;
local v21 = vector(R(), R());
v21[4] = R();
print "hole in vector of managed types", |v21|, v21;
v21[3:] = vector();
print "hole in vector of managed types after replacing slice", |v21|, v21;
} }