From 1473ae916ab0da9d86ba07a48e10ba04128da574 Mon Sep 17 00:00:00 2001 From: Dan Kortschak Date: Fri, 14 Feb 2025 06:06:13 +1030 Subject: [PATCH] x-pack/filebeat/input/entityanalytics/provider/activedirectory: fix use before init bug (#42682) The transaction tracker was not being initialised until after the first call to publishMarker in runFullSync, resulting in a nil pointer deference when the the tracker Add method is called. --- CHANGELOG.next.asciidoc | 1 + .../provider/activedirectory/activedirectory.go | 3 +-- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc index d46ee857446a..3eac8fe94637 100644 --- a/CHANGELOG.next.asciidoc +++ b/CHANGELOG.next.asciidoc @@ -223,6 +223,7 @@ otherwise no tag is added. {issue}42208[42208] {pull}42403[42403] - Remove erroneous status reporting to Elastic-Agent from the Filestream input {pull}42435[42435] - Fix truncation of bodies in request tracing by limiting bodies to 10% of the maximum file size. {pull}42327[42327] - [Journald] Fixes handling of `journalctl` restart. A known symptom was broken multiline messages when there was a restart of journalctl while aggregating the lines. {issue}41331[41331] {pull}42595[42595] +- Fix entityanalytics activedirectory provider full sync use before initialization bug. {pull}42682[42682] *Heartbeat* diff --git a/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go b/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go index c66004807b4b..0010039067e4 100644 --- a/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go +++ b/x-pack/filebeat/input/entityanalytics/provider/activedirectory/activedirectory.go @@ -257,10 +257,9 @@ func (p *adInput) runFullSync(inputCtx v2.Context, store *kvstore.Store, client } } if len(users) != 0 { - var tracker *kvstore.TxTracker start := time.Now() + tracker := kvstore.NewTxTracker(ctx) p.publishMarker(start, start, inputCtx.ID, true, client, tracker) - tracker = kvstore.NewTxTracker(ctx) for _, u := range users { p.publishUser(u, state, inputCtx.ID, client, tracker) }