Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle GetOrigin() returning nullptr for Connection #33

Open
awelzel opened this issue Jan 10, 2024 · 0 comments
Open

Handle GetOrigin() returning nullptr for Connection #33

awelzel opened this issue Jan 10, 2024 · 0 comments

Comments

@awelzel
Copy link
Contributor

awelzel commented Jan 10, 2024

As discussed with @vpax externally:

A BIF with a c: connection parameter transparently gets access to the underlying/backing Connection * object of a given connection record.

zeek::detail::BifReturnVal zeek::BifFunc::set_ssl_established_bif(zeek::detail::Frame* frame, const zeek::Args* BiF_ARGS)
        {
        ...
        zeek::Connection* c = (zeek::Connection*) ((*BiF_ARGS)[0].get()->AsRecordVal()->GetOrigin());

This breaks when used with event tracing: connection records are created artificially in script land but these do do not have a backing Connection object.

Seems reasonable to check the GetOrigin() return value and triggering a runtime error and return early if it's a nullptr. Currently with event tracing, any bif trying to access the underlying Connection ends up with a null-pointer-deref crash.

We may in the future extend Zeek to be able to create a backing connection in the core for a given connection record. The check seems useful still to prevent a proliferation of null checks in individual BIFs and give a signal when something is totally off.

Today, these BIFs provide an easy way to directly crash Zeek from script land:

$ zeek -e 'global c: connection = connection($start_time=double_to_time(0.0), $duration=1sec, $history="boom", $uid="boom"); set_ssl_established(c)'
Segmentation fault (core dumped)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant