From 41772213f92925c2154a36cb8fdf16a87b57ef0c Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Tue, 8 Oct 2024 15:40:01 +0200 Subject: [PATCH] output/http: log invalid status as a string Ticket: 7311 If response_status_number is not a valid poisitive integer, we should not try to parse it again, and fail again, but just log the raw string. --- etc/schema.json | 3 +++ src/output-json-http.c | 8 ++------ 2 files changed, 5 insertions(+), 6 deletions(-) diff --git a/etc/schema.json b/etc/schema.json index 9decf4c42bf9..fd3e68fc3f2a 100644 --- a/etc/schema.json +++ b/etc/schema.json @@ -2011,6 +2011,9 @@ "status": { "type": "integer" }, + "status_str": { + "type": "string" + }, "true_client_ip": { "type": "string" }, diff --git a/src/output-json-http.c b/src/output-json-http.c index 0c5b875ee9ad..840e99f78f69 100644 --- a/src/output-json-http.c +++ b/src/output-json-http.c @@ -296,12 +296,8 @@ static void EveHttpLogJSONExtended(JsonBuilder *js, htp_tx_t *tx) if (resp > 0) { jb_set_uint(js, "status", (uint32_t)resp); } else if (tx->response_status != NULL) { - const size_t status_size = bstr_len(tx->response_status) * 2 + 1; - char status_string[status_size]; - BytesToStringBuffer(bstr_ptr(tx->response_status), bstr_len(tx->response_status), - status_string, status_size); - unsigned int val = strtoul(status_string, NULL, 10); - jb_set_uint(js, "status", val); + jb_set_string_from_bytes(js, "status_str", bstr_ptr(tx->response_status), + (uint32_t)bstr_len(tx->response_status)); } htp_header_t *h_location = htp_table_get_c(tx->response_headers, "location");