From 27ab3768e2eaefaed7054144939f0730b3fac84f Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Tue, 22 Mar 2011 15:02:15 +0100
Subject: bugfix: RFC5424 parser confused by empty structured data
closes: http://bugzilla.adiscon.com/show_bug.cgi?id=237
---
ChangeLog | 2 ++
tools/pmrfc5424.c | 3 +--
2 files changed, 3 insertions(+), 2 deletions(-)
diff --git a/ChangeLog b/ChangeLog
index 13f6608d..de55c799 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,5 @@
+- bugfix: RFC5424 parser confused by empty structured data
+ closes: http://bugzilla.adiscon.com/show_bug.cgi?id=237
---------------------------------------------------------------------------
Version 5.7.9 [V5-BETA] (rgerhards), 2011-03-16
- improved testbench
diff --git a/tools/pmrfc5424.c b/tools/pmrfc5424.c
index 2bd18042..b06f1347 100644
--- a/tools/pmrfc5424.c
+++ b/tools/pmrfc5424.c
@@ -142,7 +142,7 @@ static int parseRFCStructuredData(uchar **pp2parse, uchar *pResult, int *pLenStr
* structured data. There may also be \] inside the structured data, which
* do NOT terminate an element.
*/
- if(lenStr == 0 || *p2parse != '[')
+ if(lenStr == 0 || (*p2parse != '[' && *p2parse != '-'))
return 1; /* this is NOT structured data! */
if(*p2parse == '-') { /* empty structured data? */
@@ -211,7 +211,6 @@ static int parseRFCStructuredData(uchar **pp2parse, uchar *pResult, int *pLenStr
*
* rger, 2005-11-24
*/
-//static int parseRFCSyslogMsg(msg_t *pMsg, int flags)
BEGINparse
uchar *p2parse;
uchar *pBuf = NULL;
--
cgit