# binpac usage of &length = -1

**URL:** <https://community.zeek.org/t/binpac-usage-of-length-1/2553>\
**Category:** Development\
**Tags:** development\
**Created:** [February 8, 2013, 10:37pm UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553 "2013-02-08T22:37:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\
**Post date:** [February 8, 2013, 10:37pm UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553/1 "2013-02-08T22:37:47Z")

</div>

Hi,

When I check the binpac source code related to FlowBuffer, I find this comment:

// A negative frame\_length represents a frame till EOF  
void NewFrame(int frame\_length, bool chunked\_);

My guess that this frame\_length is record attribute &length.

So I played with an a record

type req = record{  
header : uint8;  
data : bytestring &restofdata;  
}  
&length = -1 ;

I defined the event handler to print out header values, but I found that in .cc file, the binpac NewData is called, but nothing is printed out.

So any one has idea how this &length = -1 is used?

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [February 8, 2013, 11:19pm UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553/2 "2013-02-08T23:19:22Z")

</div>

So one thing is that I'm not sure the &length attribute transfers over  
to the NewFrame() call, don't know the internals there. Second, the  
&restofdata should already tell BinPAC++ that you want all the  
remaining data; do you find that a &length is needed in addition? (As  
usual, I'm arguing from the perspective here how I believe that binpac  
\*should\* work; that doesn't always match what it actually  
does/requires ..).

Robin

---

<div class="post-metadata">

**Author:** ![Hui\_Lin](https://avatars.discourse-cdn.com/v4/letter/h/13edae/32.png) [@Hui\_Lin](https://community.zeek.org/u/Hui_Lin)\
**Post date:** [February 10, 2013, 9:48pm UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553/3 "2013-02-10T21:48:41Z")

</div>

> > type req = record{  
> > header : uint8;  
> > data : bytestring &restofdata;  
> > }  
> > &length = -1 ;
> 
> So one thing is that I’m not sure the &length attribute transfers over  
> to the NewFrame() call, don’t know the internals there. Second, the  
> &restofdata should already tell BinPAC++ that you want all the  
> remaining data; do you find that a &length is needed in addition? (As  
> usual, I’m arguing from the perspective here how I believe that binpac  
> _should_ work; that doesn’t always match what it actually  
> does/requires …).

Unfortunately, yes, you needed the &length field. Otherwise:

/home/\*\*\*\*/bro/src/dnp3-protocol.pac:42: error : cannot handle incremental input

Then the interesting question is when binpac can handle incremental input?

---

<div class="post-metadata">

**Author:** ![robin](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/robin/32/599_2.png) [@robin](https://community.zeek.org/u/robin)\
**Post date:** [February 11, 2013, 4:00pm UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553/4 "2013-02-11T16:00:07Z")

</div>

> Unfortunately, yes, you needed the &length field. Otherwise:
> 
> /home/\*\*\*\*/bro/src/dnp3-protocol.pac:42: error : cannot handle incremental  
> input

Too bad, that sounds like a case it should be able to support rather  
easily.

> Then the interesting question is when binpac can handle incremental input?

I have no idea ... It might actually be worth looking at the code and  
see where it stumbles. And/or try the dce\_rpc approach as we  
discussed.

Robin

---

<div class="post-metadata">

**Author:** ![Hugo](https://avatars.discourse-cdn.com/v4/letter/h/b38774/32.png) [@Hugo](https://community.zeek.org/u/Hugo)\
**Post date:** [February 12, 2013, 3:21am UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553/5 "2013-02-12T03:21:38Z")

</div>

Reaching a stuck point. I included some of my studies here and also my question.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:40pm UTC](https://community.zeek.org/t/binpac-usage-of-length-1/2553/6 "2022-05-06T15:40:46Z")

</div>

Closed on May 6, 2022, 3:40pm UTC