github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-06-30 00:22:15 +00:00
Code Issues Projects Releases Wiki Activity

Prevent rule_result from leaking on error.

Browse Source 
Change falco_engine::process_event to return a unique_ptr that wraps the
rule result, so it won't be leaked if this method throws an exception.

This means that callers don't need to create their own.
This commit is contained in:
Mark Stemm 2016-12-01 09:29:17 -08:00
parent 8b116c2ad1
commit 0ee32178b7
3 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
userspace/engine/falco_engine.cpp
View File

@ -110,20 +110,20 @@ void falco_engine::enable_rule(string &pattern, bool enabled)
m_evttype_filter.enable(pattern, enabled);
}
falco_engine::rule_result *falco_engine::process_event(sinsp_evt *ev)
unique_ptr<falco_engine::rule_result> falco_engine::process_event(sinsp_evt *ev)
{
if(should_drop_evt())
{
return NULL;
return unique_ptr<struct rule_result>();
}
if(!m_evttype_filter.run(ev))
{
return NULL;
return unique_ptr<struct rule_result>();
}
struct rule_result *res = new rule_result();
unique_ptr<struct rule_result> res(new rule_result());
lua_getglobal(m_ls, lua_on_event.c_str());

2
userspace/engine/falco_engine.h
View File

@ -63,7 +63,7 @@ public:
// the rule that matched. If no rule matched, returns NULL.
//
// the reutrned rule_result is allocated and must be delete()d.
rule_result *process_event(sinsp_evt *ev);
std::unique_ptr<rule_result> process_event(sinsp_evt *ev);
//
// Print details on the given rule. If rule is NULL, print

3
userspace/falco/falco.cpp
View File

@ -171,11 +171,10 @@ uint64_t do_inspect(falco_engine *engine,
// engine, which will match the event against the set
// of rules. If a match is found, pass the event to
// the outputs.
falco_engine::rule_result *res = engine->process_event(ev);
unique_ptr<falco_engine::rule_result> res = engine->process_event(ev);
if(res)
{
outputs->handle_event(res->evt, res->rule, res->priority, res->format);
delete(res);
}
num_evts++;