mirror of
https://github.com/zeek/zeek.git
synced 2025-10-11 19:18:19 +00:00
504d22b91b
If the input framework was used to read event streams and those streams contained records with more than one field, not all elements of the threading Values were cleaned up. The reason for this is, that the SendEventStreamEvent function returned the number of record elements in the outmost record instead of the number of unrolled elements in the whole vector. This number is later used to determine how many objects to delete. Also - add a whole bunch of leak checks for the input framework that would have caught that and should cover quite a number of use-cases.
67 lines
1.5 KiB
Text
67 lines
1.5 KiB
Text
# Needs perftools support.
|
|
#
|
|
# @TEST-GROUP: leaks
|
|
#
|
|
# @TEST-REQUIRES: bro --help 2>&1 | grep -q mem-leaks
|
|
#
|
|
# @TEST-EXEC: HEAP_CHECK_DUMP_DIRECTORY=. HEAPCHECK=local btest-bg-run bro bro -m -b %INPUT
|
|
# @TEST-EXEC: btest-bg-wait 15
|
|
|
|
redef exit_only_after_terminate = T;
|
|
|
|
@TEST-START-FILE input.log
|
|
#separator \x09
|
|
#path ssh
|
|
#fields b i e c p sn a d t iv s sc ss se vc ve ns
|
|
#types bool int enum count port subnet addr double time interval string table table table vector vector string
|
|
T -42 SSH::LOG 21 123 10.0.0.0/24 1.2.3.4 3.14 1315801931.273616 100.000000 hurz 2,4,1,3 CC,AA,BB EMPTY 10,20,30 EMPTY 4242
|
|
@TEST-END-FILE
|
|
|
|
@load base/protocols/ssh
|
|
|
|
global outfile: file;
|
|
|
|
redef InputAscii::empty_field = "EMPTY";
|
|
|
|
module A;
|
|
|
|
type Idx: record {
|
|
i: int;
|
|
};
|
|
|
|
type Val: record {
|
|
b: bool;
|
|
e: Log::ID;
|
|
c: count;
|
|
p: port;
|
|
sn: subnet;
|
|
a: addr;
|
|
d: double;
|
|
t: time;
|
|
iv: interval;
|
|
s: string;
|
|
ns: string;
|
|
sc: set[count];
|
|
ss: set[string];
|
|
se: set[string];
|
|
vc: vector of int;
|
|
ve: vector of int;
|
|
};
|
|
|
|
global servers: table[int] of Val = table();
|
|
|
|
event bro_init()
|
|
{
|
|
outfile = open("../out");
|
|
# first read in the old stuff into the table...
|
|
Input::add_table([$source="../input.log", $name="ssh", $idx=Idx, $val=Val, $destination=servers]);
|
|
}
|
|
|
|
event Input::end_of_data(name: string, source:string)
|
|
{
|
|
print outfile, servers;
|
|
print outfile, to_count(servers[-42]$ns); # try to actually use a string. If null-termination is wrong this will fail.
|
|
Input::remove("ssh");
|
|
close(outfile);
|
|
terminate();
|
|
}
|