[Bro] NUL-related error messages

[Peter Wurzinger]

I noticed that my question was quite undetailled. I'll try to make it 
clearer. My code looks like this:

event signature_match( state: signature_state, msg: string, data: string)
{
         local token: pattern;
         token = string_to_pattern( "abcde", F );
         match_pattern( data, token );
}

When running this code i get the mentioned error messages. They come 
from the match_pattern call. As mentioned before, it doesn't happen for 
every packet, only for some, and these are often NetBios.

Do i need to somehow preprocess the data string before matching it? How 
can I make Bro successfully match such payloads?

Peter.





Peter Wurzinger wrote:
> Hi!
> 
> In my notice.log files i frequently find the following two error messages:
> 
> run-time error: string with embedded NUL
> run-time error: string without NUL terminator
> 
> I cannot give specific information about what packets trigger these 
> errors, but it seems that often it is NetBios. I am running Bro 1.4.
> 
> What could be the problem that causes the errors, and how could I avoid 
> them? Do these errors have an impact on signature matching (or other Bro 
> functionality)?
> 
> Peter.
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro