From 6e1cd7bbea2dac74759f8843e076a9746925be87 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Thu, 23 Mar 2023 23:49:55 -0600 Subject: [PATCH] conf: fatal error if "include" is a mapping If a field named "include" is mapping it is not processed correctly. Instead return a fatal error. In our YAML, "include" has always been a reserved word, so this should not break any known configuration. Ticket: #5939 --- src/conf-yaml-loader.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/conf-yaml-loader.c b/src/conf-yaml-loader.c index bbc3c9f889..57b793aa69 100644 --- a/src/conf-yaml-loader.c +++ b/src/conf-yaml-loader.c @@ -379,6 +379,11 @@ static int ConfYamlParse(yaml_parser_t *parser, ConfNode *parent, int inseq, int } else if (event.type == YAML_MAPPING_START_EVENT) { SCLogDebug("event.type=YAML_MAPPING_START_EVENT; state=%d", state); + if (state == CONF_INCLUDE) { + SCLogError("Include fields cannot be a mapping: line %zu", parser->mark.line); + retval = -1; + goto fail; + } if (inseq) { char sequence_node_name[DEFAULT_NAME_LEN]; snprintf(sequence_node_name, DEFAULT_NAME_LEN, "%d", seq_idx++);