[
https://bro-tracker.atlassian.net/browse/BIT-779?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13505#comment-13505
]
Mahmut Bulut edited comment on BIT-779 at 8/14/13 2:45 PM:
-----------------------------------------------------------
Its reproduced again like following:
{panel:title=Field Value Missing}
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename]
(./src/./malware/malware.bro, line 20)
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename]
(./src/./malware/malware.bro, line 20)
{panel}
but not in when statement for example:
{noformat}
event mime_one_header(c: connection, h: mime_header_rec)
{
if (/\.([eE][xX][eE]|[dD][lL][lL])/ in
c$smtp$current_entity$filename){
print "BRO BRO";
}
}
{noformat}
was (Author: vertexclique):
Its reproduced again like following:
{panel:title=Field Value Missing}
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename]
(./src/./malware/malware.bro, line 20)
ERROR: 5700.067414 field value missing [c$smtp$current_entity$filename]
(./src/./malware/malware.bro, line 20)
{panel}
> missing values cause bro to crash when used inside of a 'when' statement.
> -------------------------------------------------------------------------
>
> Key: BIT-779
> URL: https://bro-tracker.atlassian.net/browse/BIT-779
> Project: Bro Issue Tracker
> Issue Type: Problem
> Components: Bro
> Affects Versions: git/master
> Reporter: justin
> Priority: High
> Labels: InterpreterException, when
> Fix For: 2.2
>
>
> Simplest test case:
> {noformat}
> event bro_init()
> {
> local loc: geo_location;
> when (local hostname = lookup_addr(127.0.0.1)){
> print "Location", loc$country_code;
> print "ok";
> terminate();
> }
> }
> {noformat}
> gives:
> {noformat}
> terminate called after throwing an instance of 'InterpreterException'
> {noformat}
> outside of the when block, reporter.log would get:
> {noformat}
> Reporter::ERROR field value missing [loc$country_code]
> {noformat}
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://bro-tracker.atlassian.net/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
_______________________________________________
bro-dev mailing list
bro-dev@bro.org
http://mailman.icsi.berkeley.edu/mailman/listinfo/bro-dev
