Fix dissection error in dynamic_code_loading

plugins/epan/tracee-event/enrichments.c

@@ -156,12 +156,37 @@ static int enrich_security_socket_connect(tvbuff_t *tvb _U_, packet_info *pinfo,
     return enrich_security_socket_bind_connect(pinfo, "Connect");
 }
 
+static const gchar *get_mem_prot_alert_str(guint alert)
+{
+    switch (alert) {
+        case 1:
+            return "Mmaped region with W+E permissions!";
+        case 2:
+            return "Protection changed to Executable!";
+        case 3:
+            return "Protection changed from E to W+E!";
+        case 4:
+            return "Protection changed from W to E!";
+        default:
+            return "Unknown alert";
+    }
+}
+
 static int enrich_dynamic_code_loading(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, void *data _U_)
 {
-    const gchar *alert = wanted_field_get_str("tracee.args.dynamic_code_loading.triggered_by.alert");
+    const struct field_value *alert;
+    const gchar *alert_str = NULL;
+
+    if ((alert = wanted_field_get_one("tracee.args.dynamic_code_loading.triggered_by.alert")) == NULL)
+        return 0;
+
+    if (alert->type == FIELD_TYPE_STRING)
+        alert_str = alert->val.val_string;
+    else if (alert->type == FIELD_TYPE_UINT)
+        alert_str = get_mem_prot_alert_str(alert->val.val_uint);
 
-    if (alert)
-        col_append_str(pinfo->cinfo, COL_INFO, alert);
+    if (alert_str != NULL)
+        col_append_str(pinfo->cinfo, COL_INFO, alert_str);
 
     return 0;
 }
@@ -178,7 +203,7 @@ static int enrich_fileless_execution(tvbuff_t *tvb _U_, packet_info *pinfo, prot
 
 static int enrich_stdio_over_socket(tvbuff_t *tvb _U_, packet_info *pinfo, proto_tree *tree _U_, void *data _U_)
 {
-    gint *fd;
+    const gint *fd;
     const gchar *addr, *port, *stream;
 
     fd = wanted_field_get_int("tracee.args.stdio_over_socket.File_descriptor");

plugins/epan/tracee-event/process_tree.c

@@ -31,7 +31,7 @@ static struct container_info *dup_container_info(const struct container_info *co
 
 void process_tree_update(struct tracee_dissector_data *data)
 {
-    gint *fork_child_pid, *fork_child_tid;
+    const gint *fork_child_pid, *fork_child_tid;
     gint *pid_key, *pid_val;
     struct process_info *process;
 

plugins/epan/tracee-event/tracee.h

@@ -67,10 +67,10 @@ struct field_value {
 };
 
 void register_wanted_field(const gchar *filter_name);
-wmem_array_t *wanted_field_get(const gchar *filter_name);
-struct field_value *wanted_field_get_one(const gchar *filter_name);
+const wmem_array_t *wanted_field_get(const gchar *filter_name);
+const struct field_value *wanted_field_get_one(const gchar *filter_name);
 const gchar *wanted_field_get_str(const gchar *filter_name);
-gint *wanted_field_get_int(const gchar *filter_name);
+const gint *wanted_field_get_int(const gchar *filter_name);
 
 proto_item *proto_tree_add_int_wanted(proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint32 value);
 proto_item *proto_tree_add_uint_wanted(proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value);

plugins/epan/tracee-event/wanted_fields.c

@@ -26,24 +26,24 @@ void register_wanted_field(const gchar *filter_name)
     wmem_map_insert(wanted_fields, key, NULL);
 }
 
-wmem_array_t *wanted_field_get(const gchar *filter_name)
+const wmem_array_t *wanted_field_get(const gchar *filter_name)
 {
     return wmem_map_lookup(wanted_field_values, filter_name);
 }
 
-struct field_value *wanted_field_get_one(const gchar *filter_name)
+const struct field_value *wanted_field_get_one(const gchar *filter_name)
 {
-    wmem_array_t *values = wanted_field_get(filter_name);
+    const wmem_array_t *values = wanted_field_get(filter_name);
 
-    if (values && wmem_array_get_count(values) >= 1)
-        return *((struct field_value **)wmem_array_index(values, 0));
+    if (values && wmem_array_get_count((wmem_array_t *)values) >= 1)
+        return *((struct field_value **)wmem_array_index((wmem_array_t *)values, 0));
 
     return NULL;
 }
 
 const gchar *wanted_field_get_str(const gchar *filter_name)
 {
-    struct field_value *fv;
+    const struct field_value *fv;
 
     if ((fv = wanted_field_get_one(filter_name)) == NULL)
         return NULL;
@@ -52,9 +52,9 @@ const gchar *wanted_field_get_str(const gchar *filter_name)
     return fv->val.val_string;
 }
 
-gint *wanted_field_get_int(const gchar *filter_name)
+const gint *wanted_field_get_int(const gchar *filter_name)
 {
-    struct field_value *fv;
+    const struct field_value *fv;
 
     if ((fv = wanted_field_get_one(filter_name)) == NULL)
         return NULL;