Merge pull request #1618 from atomicturtle/fix-lf-location-array-from-unknow-syslog

Fix lf location array from unknown syslog

Author: ddpbsd

src/analysisd/format/json_extended.c

@@ -251,15 +251,18 @@ int W_isRootcheck(cJSON *root, int nested){
 // ** TODO ** Regex instead str_cut
 void W_JSON_ParseHostname(cJSON *root, char *hostname){
 	if(hostname[0] == '('){
-		char *e;
-		char string[strlen(hostname) + 1];
-		strcpy(string,hostname);
+                char *search;
+                char string[MAX_STRING];
+                strncpy(string,hostname,MAX_STRING - 1);
 		int index;
-		e = strchr(string, ')');
-		index = (int)(e - string);
-		str_cut(string, index, -1);
-		str_cut(string, 0, 1);
-		cJSON_AddStringToObject(root, "hostname", string);
+                search = strchr(string, ')');
+                if(search){
+                       index = (int)(search - string);
+                       str_cut(string, index, -1);
+                       str_cut(string, 0, 1);
+                       cJSON_AddStringToObject(root, "hostname", string);
+                }
+
 	}else{
 		cJSON_AddStringToObject(root, "hostname", hostname); 
 	}  
@@ -276,36 +279,41 @@ void W_JSON_ParseHostname(cJSON *root, char *hostname){
 // ** TODO ** Regex instead str_cut
  void W_JSON_ParseAgentIP(cJSON *root, const Eventinfo *lf){
     if(lf->hostname[0] == '('){
-       char *e;
-       char string[strlen(lf->hostname) + 1];
-       strcpy(string,lf->hostname);
+       char *search;
+       char string[MAX_STRING];
+       strncpy(string,lf->hostname,MAX_STRING - 1);
        int index;
-       e = strchr(string, ')');
-       index = (int)(e - string);
-       str_cut(string, 0, index);
-       str_cut(string, 0, 2);
-       e = strchr(string, '-');
-       index = (int)(e - string);
-       str_cut(string, index, -1);
-       cJSON_AddStringToObject(root, "agentip", string);
+       search = strchr(string, ')');
+       if(search){
+              index = (int)(search - string);
+              str_cut(string, 0, index);
+              str_cut(string, 0, 2);
+              search = strchr(string, '-');
+              index = (int)(search - string);
+              str_cut(string, index, -1);
+              cJSON_AddStringToObject(root, "agentip", string);
+          }
     }
 
  }
  // The file location usually comes with more information about the alert (like hostname or ip) we will extract just the "/var/folder/file.log".
 void W_JSON_ParseLocation(cJSON *root, const Eventinfo *lf, int archives){
 	if(lf->location[0] == '('){
-		char *e;
-		char string[strlen(lf->location)];
-		strcpy(string,lf->location);
+                char *search;
+                char string[MAX_STRING];
+                strncpy(string,lf->location,MAX_STRING - 1);
 		int index;
-		e = strchr(string, '>');
-		index = (int)(e - string);
-		str_cut(string, 0, index);
-		str_cut(string, 0, 1);
-		if(archives == 1)
-			cJSON_AddStringToObject(root, "location_desc", string);
-		else
-			cJSON_AddStringToObject(root, "location", string);
+                search = strchr(string, '>');
+                if(search){
+                        index = (int)(search - string);
+                        str_cut(string, 0, index);
+                        str_cut(string, 0, 1);
+
+                        if(archives == 1)
+                                cJSON_AddStringToObject(root, "location_desc", string);
+                        else
+                                cJSON_AddStringToObject(root, "location", string);
+                }
 	}else{
 		if(archives == 1)
 			cJSON_AddStringToObject(root, "location_desc", lf->location);
@@ -382,9 +390,3 @@ void trim(char * s) {
 
     memmove(s, p, l + 1);
 }
-void removeChar( char * string, char letter ) {
-	unsigned int i;
-	for(i = 0; i < strlen( string ); i++ )
-		if( string[i] == letter )
-	  		strcpy( string + i, string + i + 1 );
-}

src/analysisd/format/to_json.c

@@ -289,8 +289,6 @@ char *Archiveinfo_to_jsonstr(const Eventinfo *lf)
             cJSON_AddNumberToObject(decoder, "fts", lf->decoder_info->fts);
         if (lf->decoder_info->accumulate) 
             cJSON_AddNumberToObject(decoder, "accumulate", lf->decoder_info->accumulate);
-        if (lf->decoder_info->accumulate) 
-            cJSON_AddNumberToObject(decoder, "accumulate", lf->decoder_info->accumulate);
 
         if (lf->decoder_info->parent) 
             cJSON_AddStringToObject(decoder, "parent", lf->decoder_info->parent);