Is it is a code issue about bro-2.3?


BroFile::Write() in src/,

len = fwrite(data, 1, len, f);

if ( len <=0 )

return false;

Maybe, the method to check the return value of fwrite is incorrect. We should call ferror to check file operation’s result. The following is fixing.

len = fwrite(data, 1, len, f);

if ( ferror(f) ) {


return false;


Would you please verify this question?


Hello Robert,

according to the fwrite manual pages:

"If an error occurs, or the end-of-file is reached, the return value is a
short object count (or zero)."

According to this, checking ferror is unnecessary for fwrites. However you
are right that just checking that the len is 0 is not enough, instead we
should check that the number of bytes written is equal to the number of
bytes we wanted to write, i.e.

if ( fwrite(data, 1, len, f) < len )
  return false;

There are a few more fwrite calls in the file before that, I will give it
a quick pass and submit a patch later today.