[Bro] Side effects on record fields when triggering events

Christian Kreibich christian at whoop.org
Wed Aug 31 18:39:47 PDT 2005

On Tue, 2005-08-30 at 21:47 -0700, Vern Paxson wrote:
> > Okay Chema and I tracked it down to the reference counting that is going
> > on in the core
> Exactly.  Aggregates in Bro are passed as shallow copiess, not deep copies.
> There are times when it would be handy to have an operator to specify
> deep-copy semantics.  I share your concern at the counter-intuitive behavior
> that shallow-copy semantics can provide, but blanket deep-copy can be very
> expensive, and needlessly so in many cases.

Yeah I agree. It's also not too big a big deal if you have the way it
works in mind while writing policy code. I think I'll grow your patch
queue with some documentation. :)


More information about the Bro mailing list