tstack / lnav

Log file navigator
http://lnav.org
BSD 2-Clause "Simplified" License
7.62k stars 303 forks source link

Crash when regex without body is used #1289

Open dmig opened 1 month ago

dmig commented 1 month ago

lnav version v0.12.2, Macos

Describe the bug I created a custom format file with 2 regexes, one matches subset of messages from another. Since lnav doesn't stop at first matched regex (shouldn't this be a default behavior?), I added a negative lookahead to one of them. lnav silently stopped loading. When started with -WC, it reports a crash. Without negative lookahead in regex lnav runs, but more generic regex is always used. When started with -WC, it reports a warning about two matching regexes:

⚠ warning: invalid log format: “test”
   reason: sample is matched by more than one regex: request_profiler, std
 --> /Users/dmig/.config/lnav/formats/installed/test.json:55
 | [new-dev][28245.8575077376] [2024-07-24 11:59:24,071] [INFO] [request_profiler] [-] [GET] [http://new-dev.localhost:5000/api/v1/globalsearch/Polytetrafluoroethylene?filter=all&page=1] [START]
 =   help: log format regexes must match a single type of log message
⚠ warning: invalid log format: “test”
   reason: sample is matched by more than one regex: request_profiler, std
 --> /Users/dmig/.config/lnav/formats/installed/test.json:59
 | [new-dev][28245.8575077376] [2024-07-24 11:59:26,528] [INFO] [request_profiler] [#5:3005] [GET] [http://new-dev.localhost:5000/api/v1/globalsearch/Polytetrafluoroethylene?filter=all&page=1] [2.4576] [FINISH]
 =   help: log format regexes must match a single type of log message

To Reproduce Steps to reproduce the behavior:

  1. install attached format test.json
  2. try to open attached log file test.log as lnav test.log, lnav -WC test.log
  3. edit test.json, regex.std.pattern: remove (?!request_profiler) substring
  4. repeat step 2

Crash log: crash-2024-07-24-14-15-06.40537.log

dmig commented 1 month ago

Ok, I discovered the reason wrong: it's not the backtrack, it's the regex without body. But shouldn't crash anyway.

tstack commented 1 month ago

It looks like it's because a module field is defined with a body field. The validator should check for that.