<div dir="ltr">Hello Zeekers,<br><div><br></div><div>I'm currently in the process of migrating from Bro 2.6.2 to Zeek 3.0.0, and I'm experiencing a small headache with segmentation fault in my plugins. I didn't have this issue with Bro 2.6.2, so I'm not 100% sure what happened here.</div><div><br></div><div>After making name changes from Bro to Zeek, I was able to successfully compile all of the plugins. When I ran them against pcaps that are specified for the plugin, I noticed that some of the plugins threw a segmentation fault ("Segmentation fault (core dumped)"). I was replaying a pcap file like what I usually do by running:</div><div>cd ~/Desktop/logs/ && sudo rm -f *.log && zeek -C -t ~/Desktop/logs/output.log -r ~/Desktop/pcap/
testPlugin1_pcap_1.pcapng<br></div><div><br></div><div>After some troubleshooting, I noticed that only the ones that had a switch case statement inside a while loop inside main.zeek were affected by this. I do have checks to prevent resource exhaustion, so I'm not sure why the new version is not happy. Anyway, I was able to verify by cd into "/usr/local/zeek/lib/zeek/plugins/Zeek_testPlugin1/scripts" and commenting out the affected section in main.zeek. Even something as simple as this throws segmentation fault:</div><div><br></div><div>while (index < payload_length) {<br> header = bytestring_to_count(data[index]);<br>
len = 0;<br>
index += 1;<br>
switch (header) {<br>
default: ##! test<br>
break;<br>
}</div><div> # dummy check as example </div><div>                
if (index > 10) {<br>                        
break;<br>                
}<br>}<br></div><div><br></div><div>I've been looking at this for the last 8 hours, so more eyes would be appreciated.</div><div><br></div><div>Thanks,</div></div>