valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[Fix #1356] Tokenize process environ by '\0' on Linux

Browse Source
This commit is contained in:
Teddy Reed 2015-07-19 14:34:49 -07:00
parent 6bfe03f6e9
commit bcdbb40f0c
2 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
osquery/core/text.cpp
View File

@ -21,8 +21,10 @@ namespace osquery {
std::vector<std::string> split(const std::string& s, const std::string& delim) {
std::vector<std::string> elems;
boost::split(elems, s, boost::is_any_of(delim));
auto start = std::remove_if(
elems.begin(), elems.end(), [](const std::string& s) { return s == ""; });
auto start =
std::remove_if(elems.begin(), elems.end(), [](const std::string& s) {
return s.size() == 0;
});
elems.erase(start, elems.end());
for (auto& each : elems) {
boost::algorithm::trim(each);
@ -35,7 +37,7 @@ std::vector<std::string> split(const std::string& s,
size_t occurences) {
// Split the string normally with the required delimiter.
auto content = split(s, delim);
// While the result split exceeds the number of requested occurences, join.
// While the result split exceeds the number of requested occurrences, join.
std::vector<std::string> accumulator;
std::vector<std::string> elems;
for (size_t i = 0; i < content.size(); i++) {

7
osquery/tables/system/linux/processes.cpp
View File

@ -61,7 +61,11 @@ void genProcessEnvironment(const std::string& pid, QueryData& results) {
std::string content;
readFile(attr, content);
for (const auto& buf : osquery::split(content, "\n")) {
const char* variable = content.c_str();
// Stop at the end of nul-delimited string content.
while (*variable > 0) {
auto buf = std::string(variable);
size_t idx = buf.find_first_of("=");
Row r;
@ -69,6 +73,7 @@ void genProcessEnvironment(const std::string& pid, QueryData& results) {
r["key"] = buf.substr(0, idx);
r["value"] = buf.substr(idx + 1);
results.push_back(r);
variable += buf.size() + 1;
}
}