[Bro-Dev] #780: file extraction trunctation.

Bro Tracker bro at tracker.bro-ids.org
Tue Feb 21 12:34:54 PST 2012


#780: file extraction trunctation.
------------------------+---------------------------------------
 Reporter:  justin      |       Type:  Problem
   Status:  new         |   Priority:  Normal
Milestone:              |  Component:  Bro
  Version:  git/master  |   Keywords:  file extraction truncated
------------------------+---------------------------------------
 Tracked this down a while ago but forgot to submit it.  I was running into
 an issue with the http file extraction.  The files were being extracted
 properly, but then the files were being truncated to zero length.  The
 reason turned out to be that the file object was being serialized, and
 then when deserialized, it was being re-opened and truncated.  This also
 leaks file handles.

 putting a breakpoint on Open found this:

 {{{
 #0  BroFile::Open (this=0x39108a0, file=0x0) at
 /spare/tmp/workshop/bro/src/File.cc:176
 #1  0x00000000005939b3 in BroFile::Unserialize (info=0x7fff08c75170) at
 /spare/tmp/workshop/bro/src/File.cc:853
 #2  0x00000000006602cb in Val::DoUnserialize (this=0x3910760,
 info=0x7fff08c75170) at /spare/tmp/workshop/bro/src/Val.cc:397
 #3  0x0000000000627ee8 in SerialObj::Unserialize (info=0x7fff08c75170,
 type=34817)
     at /spare/tmp/workshop/bro/src/SerialObj.cc:220
 #4  0x000000000065fbe8 in Val::Unserialize (info=0x39108a0, type=TYPE_ANY,
 exact_type=0x0)
     at /spare/tmp/workshop/bro/src/Val.cc:101
 #5  0x0000000000660749 in Val::Unserialize (this=0x356e320,
 info=0x7fff08c75170) at /spare/tmp/workshop/bro/src/Val.h:332
 #6  RecordVal::DoUnserialize (this=0x356e320, info=0x7fff08c75170) at
 /spare/tmp/workshop/bro/src/Val.cc:3067
 #7  0x0000000000627ee8 in SerialObj::Unserialize (info=0x7fff08c75170,
 type=34817)
     at /spare/tmp/workshop/bro/src/SerialObj.cc:220
 #8  0x000000000065fbe8 in Val::Unserialize (info=0x39108a0,
 type=TYPE_RECORD, exact_type=0x0)
 }}}

-- 
Ticket URL: <http://tracker.bro-ids.org/bro/ticket/780>
Bro Tracker <http://tracker.bro-ids.org/bro>
Bro Issue Tracker



More information about the bro-dev mailing list