[Bro] deleting objects passed to BiF event handlers

Siwek, Jonathan Luke jsiwek at illinois.edu
Mon Oct 21 07:50:49 PDT 2013

On Oct 19, 2013, at 6:35 PM, James Hook <jamesfhook at gmail.com> wrote:

> I've just been working through the example of creating built in functions http://www.bro.org/development/howtos/bif-doc/example.html
> I have a quick question about what the design pattern should be for deleting objects created and passed to the firing event handler. For example, in the code below, is deleting the msg pointer likely to cause problems to QueueEvent?

Yes (it will probably cause a double-free when there's a bif_test_event handler).  EventMgr::QueueEvent takes ownership of the val_list and a single reference count to any elements in it.

> Or does the StringVal class do something clever behind the scenes to stop memory leaks?

No.  I'll fix the example code in the docs to better demonstrate correct memory management -- which probably the best way is to just not allocate a Val or val_list unless it's known it's going to get passed to EventMgr::QueueEvent.

- Jon

More information about the Bro mailing list