From: Eric Leblond <eric@regit.org>
Date: Mon, 4 May 2015 16:11:37 +0000 (+0200)
Subject: email-json: delete leading white spaces
X-Git-Tag: suricata-3.0RC1~111
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=abcaf46193474dc4a1acc6984da1318570c16d58;p=thirdparty%2Fsuricata.git

email-json: delete leading white spaces

Some mail clients are using tabulation and/or space for comma
separated list. This patch removes them so the event will contain
only significative characters.
---

diff --git a/src/output-json-email-common.c b/src/output-json-email-common.c
index d539308a98..533ce17ade 100644
--- a/src/output-json-email-common.c
+++ b/src/output-json-email-common.c
@@ -76,21 +76,41 @@ struct {
     { NULL, NULL, LOG_EMAIL_DEFAULT},
 };
 
+static inline char *SkipWhiteSpaceTill(char *p, char *savep)
+{
+    char *sp = p;
+    if (unlikely(p == NULL)) {
+        return NULL;
+    }
+    while (((*sp == '\t') || (*sp == ' ')) && (sp < savep)) {
+        sp++;
+    }
+    return sp;
+}
+
 static json_t* JsonEmailJsonArrayFromCommaList(const uint8_t *val, size_t len)
 {
     json_t *ajs = json_array();
     if (likely(ajs != NULL)) {
         char *savep = NULL;
         char *p;
+        char *sp;
         char *to_line = BytesToString((uint8_t *)val, len);
         if (likely(to_line != NULL)) {
             p = strtok_r(to_line, ",", &savep);
-            json_array_append_new(ajs, json_string(p));
+            if (p == NULL) {
+                json_decref(ajs);
+                SCFree(to_line);
+                return NULL;
+            }
+            sp = SkipWhiteSpaceTill(p, savep);
+            json_array_append_new(ajs, json_string(sp));
             while ((p = strtok_r(NULL, ",", &savep)) != NULL) {
-                json_array_append_new(ajs, json_string(&p[strspn(p, " ")]));
+                sp = SkipWhiteSpaceTill(p, savep);
+                json_array_append_new(ajs, json_string(sp));
             }
-            SCFree(to_line);
         }
+        SCFree(to_line);
     }
 
     return ajs;