[Bro] pcap_next Question

Robin Sommer robin at icir.org
Thu Aug 9 16:00:28 PDT 2012

On Thu, Aug 09, 2012 at 18:49 -0400, Chris Crawford wrote:

> The if-statement that follows still doesn't make sense to me, though:

Yes, agreed.

> It seems like a logical place to print an "out of memory" message to
> the logs would be just before an abort in the function registered in
> bro_new_handler() to handle catching std::bad_alloc errors.

Indeed, that's what should happen once the handler gets installed
(with the caveat that the logging might not work if it needs to
allocate memory itself).


Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL    * Fax   +1 (510) 666-2956 *   www.icir.org

More information about the Bro mailing list