zeek/spicy

Field of type with filter consumes more data than expected

Closed this issue · 1 comments

Given the following code

module foo;

const N: uint64 = 1;

public type X = unit {
    y: Y &max-size=N;
    z: bytes &eod &requires=|$$|!=0;
};

type Y = unit {
    on %init {
        self.connect_filter(new F);
    }

    data: bytes &size=N;
};

type F = unit {
    %filter;

    filter_input: bytes &size=N {
        print $$;
        self.forward($$);
    }
};

For an input \x01\x02\x03 I would expect y to consume exactly one (N) byte since the filter connected to Y consumes one byte. It looks however as if that is not the case and the &max-size check fails; if I remove the check I still see no data in z so it looks to me as if the filter consumes all input.

Printing filter_input shows a single byte so I suspect this is happening outside of the parsing of F in how we update the view it operates on.

This seems to be broken from at least 1.4.0 on (before d15281b we rejected above reproducer).

The issue here is that we seem to trim too much, at least once in the filter and again for the field. One of these seems to see the wrong cur. Currently we do not set up new parser state for parsing in filters which might be required for some functionality, but I suspect contributes to the issue here.

builder()->addExpression(builder::memberCall(state().self, id_stage2, args2));