[Bro] possible bug

john mcnicholas jomcn at mail.com
Fri Nov 5 06:11:28 PST 2004


I believe I came across a minor bug in the 0.94 and 0.97 bro code.  I'm  
still new to this project, so it is possible the problem is a user  

In short, when TCP_Connection::SetContentsFile is called with the  
CONTENTS_BOTH value as the direction, the BroFile object reference  
counter needs to be incremented else one will encounter an internal  
reference count error. (or something similar, I don't recall the exact  
message).  In the 0.94 build the program would immediately exit.


- below is a temporary work around that i added.  I'm not that familiar  
with the bro code so I imagine there are other solutions and I'm not  
recommending one over another.
- here is an outline/fragment of a bro script  to generate the error.

event connection_established( c: connection )
          #  1. see if appropriate protocol/port is being used

	local filename: string;
	local f : file;

          # 2. NOTE: construct appropriate filename here

	f = open(filename);

Please let me know if you'd like additional information.



void TCP_Connection::SetContentsFile(unsigned int direction, BroFile* f)
	if ( direction == CONTENTS_NONE )

		if ( direction == CONTENTS_ORIG || direction == CONTENTS_BOTH )
		if ( direction == CONTENTS_RESP || direction == CONTENTS_BOTH )

        //   this is a wor
         if (direction==CONTENTS_BOTH)
             // JGM: workaround increment the reference count for
             // the file object

             // Ref((BroObj *)f);
             Ref(f);    //  need to include "File.h"

More information about the Bro mailing list