From 0ea289bd8840d95b90869ae39a569b6e54514984 Mon Sep 17 00:00:00 2001 From: Mark Stemm Date: Tue, 21 Aug 2018 12:45:15 -0700 Subject: [PATCH] Don't return local strings from proto filterchecks These were returning pointers to local string values on the stack. Replace with m_tstr, a general purpose string in the object, instead. --- userspace/libsinsp/filterchecks.cpp | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/userspace/libsinsp/filterchecks.cpp b/userspace/libsinsp/filterchecks.cpp index 0e3155c82b..fa54868c1e 100644 --- a/userspace/libsinsp/filterchecks.cpp +++ b/userspace/libsinsp/filterchecks.cpp @@ -776,17 +776,17 @@ uint8_t* sinsp_filter_check_fd::extract(sinsp_evt *evt, OUT uint32_t* len, bool return NULL; } - string port = ""; + m_tstr = ""; if(evt_type == SCAP_FD_IPV4_SOCK) { - port = port_to_string(m_fdinfo->m_sockinfo.m_ipv4info.m_fields.m_sport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); + m_tstr = port_to_string(m_fdinfo->m_sockinfo.m_ipv4info.m_fields.m_sport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); } else if(evt_type == SCAP_FD_IPV6_SOCK) { - port = port_to_string(m_fdinfo->m_sockinfo.m_ipv6info.m_fields.m_sport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); + m_tstr = port_to_string(m_fdinfo->m_sockinfo.m_ipv6info.m_fields.m_sport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); } - RETURN_EXTRACT_STRING(port); + RETURN_EXTRACT_STRING(m_tstr); } case TYPE_SERVERPORT: { @@ -868,17 +868,17 @@ uint8_t* sinsp_filter_check_fd::extract(sinsp_evt *evt, OUT uint32_t* len, bool return NULL; } - string port = ""; + m_tstr = ""; if(evt_type == SCAP_FD_IPV4_SOCK) { - port = port_to_string(nport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); + m_tstr = port_to_string(nport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); } else if(evt_type == SCAP_FD_IPV6_SOCK) { - port = port_to_string(nport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); + m_tstr = port_to_string(nport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); } - RETURN_EXTRACT_STRING(port); + RETURN_EXTRACT_STRING(m_tstr); } case TYPE_LPORT: case TYPE_RPORT: @@ -1049,9 +1049,8 @@ uint8_t* sinsp_filter_check_fd::extract(sinsp_evt *evt, OUT uint32_t* len, bool } } - string port = ""; - port = port_to_string(nport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); - RETURN_EXTRACT_STRING(port); + m_tstr = port_to_string(nport, this->m_fdinfo->get_l4proto(), m_inspector->m_hostname_and_port_resolution_enabled); + RETURN_EXTRACT_STRING(m_tstr); } case TYPE_L4PROTO: