[Bro-Dev] [JIRA] (BIT-779) missing values cause bro to crash when used inside of a 'when' statement.

[Mahmut Bulut (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-779?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13505#comment-13505 ] 

Mahmut Bulut edited comment on BIT-779 at 8/14/13 2:45 PM:
-----------------------------------------------------------

Its reproduced again like following:
{panel:title=Field Value Missing}
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename] (./src/./malware/malware.bro, line 20)
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename] (./src/./malware/malware.bro, line 20)
{panel}
but not in when statement for example:
{noformat}
event mime_one_header(c: connection, h: mime_header_rec)
	{
		if (/\.([eE][xX][eE]|[dD][lL][lL])/ in c$smtp$current_entity$filename){
			print "BRO BRO";
		}
    }
{noformat}
                
      was (Author: vertexclique):
    Its reproduced again like following:
{panel:title=Field Value Missing}
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename] (./src/./malware/malware.bro, line 20)
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename] (./src/./malware/malware.bro, line 20)
{panel}

                  
> missing values cause bro to crash when used inside of a 'when' statement.
> -------------------------------------------------------------------------
>
>                 Key: BIT-779
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-779
>             Project: Bro Issue Tracker
>          Issue Type: Problem
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: justin
>            Priority: High
>              Labels: InterpreterException, when
>             Fix For: 2.2
>
>
> Simplest test case:
> {noformat}
> event bro_init()
> {
>     local loc: geo_location;
>     when (local hostname = lookup_addr(127.0.0.1)){
>         print "Location", loc$country_code;
>         print "ok";
>         terminate();
>     }
> }
> {noformat}
> gives:
> {noformat}
> terminate called after throwing an instance of 'InterpreterException'
> {noformat}
> outside of the when block, reporter.log would get:
> {noformat}
> Reporter::ERROR	field value missing [loc$country_code]
> {noformat}

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://bro-tracker.atlassian.net/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira