deleting objects passed to BiF event handlers

Zeek
1

Hi all,

I’ve just been working through the example of creating built in functions http://www.bro.org/development/howtos/bif-doc/example.html

I have a quick question about what the design pattern should be for deleting objects created and passed to the firing event handler. For example, in the code below, is deleting the msg pointer likely to cause problems to QueueEvent?

Or does the StringVal class do something clever behind the scenes to stop memory leaks?

Many thanks in advance

James

2

I've just been working through the example of creating built in functions http://www.bro.org/development/howtos/bif-doc/example.html

I have a quick question about what the design pattern should be for deleting objects created and passed to the firing event handler. For example, in the code below, is deleting the msg pointer likely to cause problems to QueueEvent?

Yes (it will probably cause a double-free when there's a bif_test_event handler). EventMgr::QueueEvent takes ownership of the val_list and a single reference count to any elements in it.

Or does the StringVal class do something clever behind the scenes to stop memory leaks?

No. I'll fix the example code in the docs to better demonstrate correct memory management -- which probably the best way is to just not allocate a Val or val_list unless it's known it's going to get passed to EventMgr::QueueEvent.

- Jon

3

Thanks Jon, that makes a sense.