github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-08-07 09:13:57 +00:00
Code Issues Projects Releases Wiki Activity

fix(engine): save syscall source only when processing events

Browse Source 
The optimization in https://github.com/falcosecurity/falco/pull/2210
had a bug when the engine uses multiple sources at the same
time--m_syscall_source is a pointer to an entry in the indexed vector
m_sources, but if add_source is called multiple times, the vector is
resized, which copies the structs but invalidates any pointer to the
vector entries.

So instead of caching m_syscall_source in add_source(), cache it in
process_events(). m_sources won't change once processing events starts.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm 2022-10-25 10:02:22 -07:00 committed by poiana
parent 4a4fa2592b
commit acf5c4ce5f
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
userspace/engine/falco_engine.cpp
View File

@ -346,6 +346,11 @@ unique_ptr<falco_engine::rule_result> falco_engine::process_event(std::size_t so
if(source_idx == m_syscall_source_idx) if(source_idx == m_syscall_source_idx)
{ {
if(m_syscall_source == NULL)
{
m_syscall_source = find_source(m_syscall_source_idx);
}
source = m_syscall_source; source = m_syscall_source;
} }
else else
@ -387,7 +392,6 @@ std::size_t falco_engine::add_source(const std::string &source,
if(source == falco_common::syscall_source) if(source == falco_common::syscall_source)
{ {
m_syscall_source_idx = idx; m_syscall_source_idx = idx;
m_syscall_source = find_source(m_syscall_source_idx);
} }
return idx; return idx;