[Bro-Dev] #679: Add support for deleting vector elements

Bro Tracker bro at tracker.bro-ids.org
Wed Nov 16 12:53:56 PST 2011

#679: Add support for deleting vector elements
  Reporter:  matthias  |      Owner:
      Type:  Problem   |     Status:  new
  Priority:  Normal    |  Milestone:  Bro2.0
 Component:  Bro       |    Version:  git/master
Resolution:            |   Keywords:

Comment (by matthias):

 Run this and you'll see weirdness:

 global v: vector of string;

 event bro_init()
     print v;
     v[3] = "foo";
     print v;
     print "-------------------";

     local x = v[42];
     print x;

 The output is:
 [, , , foo]
 if (Notice::ACTION_DROP in Notice::n$actions)


 Replying to [comment:3 robin]:
 > What does a vector do if I insert an element way beyond the current
 > end? Does it expand and fill with null values in between? If so, I
 > already don't like that, because Bro doesn't really have null values.

 Per the above example, yes, Bro expands the vector and fills it with NULL

 > Using one of those fields will probably cause a crash (or is it caught
 > and causes a run-time error?)

 Worse, you get a very weird value back that has nothing to do with the
 vector itself.

 > Is there a way to test if a vector value is set? (As you can tell, I
 have pretty much
 > avoided using vectors in the past :-)

 I'm not aware of any mechanism to test this.

 > One way to solve all this would be giving vectors a &default
 > attribute to specify a value to be returned by default.

 Trying this fails:
 global v: vector of string &default="foo";
 with the output:
 error in ./vector.bro, line 1: &default value has inconsistent type (foo
 and vector)
 fatal error in ./vector.bro, line 1: BroType::AsTableType (vector/table)

 Weird enough? :-)

Ticket URL: <http://tracker.bro-ids.org/bro/ticket/679#comment:4>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker

More information about the bro-dev mailing list