beave / meer

Meer (GPLv2) is a dedicated "spooler" for the Suricata & Sagan EVE output formats.
23 stars 6 forks source link

Probably copy & paste error resulting in Signal 6 when processing json #17

Open rueddldueddl opened 4 years ago

rueddldueddl commented 4 years ago

gcc -DHAVE_CONFIG_H -I. -I.. -I.. -I/opt/local/include -g -O2 -DDarwin -MT meer-decode-json-alert.o -MD -MP -MF .deps/meer-decode-json-alert.Tpo -c -o meer-decode-json-alert.o test -f 'decode-json-alert.c' || echo './'decode-json-alert.c decode-json-alert.c:341:21: warning: 'builtin_strlcpy_chk' will always overflow destination buffer [-Wbuiltin-memcpy-chk-size] strlcpy(Alert_Return_Struct->alert_gid, (char *)json_object_get_string(tmp_alert), sizeof(Alert_Return_Struct->alert_action)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ /usr/include/secure/_string.h:108:3: note: expanded from macro 'strlcpy' builtin_strlcpy_chk (dest, __VA_ARGS, darwin_obsz (dest)) ^~~~~~~~~~~~~~~~~ 1 warning generated.

When building nonetheless and running meer, a Signal 6 will be thrown when processing the json. Line 341 in decode-json-alert.c should be: strlcpy(Alert_Return_Struct->alert_gid, (char )json_object_get_string(tmp_alert), sizeof(Alert_Return_Struct-> alert_gid)); rather than: strlcpy(Alert_Return_Struct->alert_gid, (char )json_object_get_string(tmp_alert), sizeof(Alert_Return_Struct->alert_action));