Commit graph

1 commit

Author SHA1 Message Date
Jon Siwek
d3ace9b7ac GH-1506: Fix Broker unserialization of set/table function indices
Zeek function types are serialized as a broker::vector, but the
unserialization logic for Zeek set/table types that use a function for
as an index incorrectly identified it as a composite-index, which also
use broker::vector, rather than a singleton-index, and makes such
unserialization fail.

A general example where this failure can happen in practice is when
trying to unserialize a connection record for which there's a
Conn::RemovalHook, since that's a set[function], and a specific case of
that is use of the Intel Framework in a Zeek cluster.
2021-04-15 01:13:51 -07:00