[Bro] a small patch to binpac

[Ruoming Pang]

Thanks! I will integrate this patch.

Ruoming

On 6/4/07, jmzhou.ml at gmail.com <jmzhou.ml at gmail.com> wrote:
> The problem:
>
>      type MyRecord = record {
>          f1:   SomeRecordType;
>          f2:   bytestring &length=body_len;
>      } &let {
>          body_len: uint32 = f1.rec_len - sizeof (f1);
>      };
>
> The above definition looks familiar, uh? It is a simplifed version of
> the DCE RPC PDU. If MyRecord is incrementally parsed, the sizeof (f1)
> in the &let construct will cause trouble because getFieldBegin and
> getFieldEnd can only be used for non-incremental parsed record. If
> the size of SomeRecordType is decideable statically (in the case of
> DCE RPC, it is), then the patch fixes the problem. Now we can make
> the PDU incrementally parsed.
>
> Cheers,
>
> Jimmy
>
> ____________________________________________________________
> The future is not set.  There is no fate but what we make
> for ourselves.             - Terminator II, Judgment Day
> ------------------------------------------------------------
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro
>
>