Skip to contentSkip to conversation

Fix error handing when searching for an interpreted value

PATCH Applied Miloslav Trmac 2 participants 2 messages Jan 31, 2008

lore
Share & tools
lore

Miloslav Trmac

author
#0 lore raw

PATCH 1/1 Fix error handing when searching for an interpreted value

Hello,
auparse would crash if there was an interpreted filter item defined and the field could not be interpreted (e.g. it had an invalid format).

The attached patch modifies auparse to use the raw value in such cases.
Mirek

auparse/auparse.c +2 -1
diff -ur audit/auparse/auparse.c audit-1.6.6/auparse/auparse.c
@@ -899,9 +899,10 @@
 		if (search_op == AUSEARCH_EXISTS)
 			return 1;
 
+		val = NULL;
 		if ((rule->search_op & AUSEARCH_INTERPRETED) != 0)
 			val = nvlist_interp_cur_val(r);
-		else
+		if (val == NULL)
 			val = nvlist_get_cur_val(&r->nv);
 		rc = strcmp(rule->v.field.val, val);
 		if (search_op == AUSEARCH_EQUAL)
Applied
#1 lore raw
Quoted 2 lines · On Thursday 31 January 2008 04:02:06 Miloslav Trmac wrote:

auparse would crash if there was an interpreted filter item defined and the field could not be interpreted (e.g. it had an invalid format).

Applied, thanks!

-Steve