mirror of
https://github.com/falcosecurity/falco.git
synced 2026-02-22 06:37:34 +00:00
The optimization in https://github.com/falcosecurity/falco/pull/2210 had a bug when the engine uses multiple sources at the same time--m_syscall_source is a pointer to an entry in the indexed vector m_sources, but if add_source is called multiple times, the vector is resized, which copies the structs but invalidates any pointer to the vector entries. So instead of caching m_syscall_source in add_source(), cache it in process_events(). m_sources won't change once processing events starts. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>