From 927ae53ecd9655c3c5b843b7ebf619f553be848d Mon Sep 17 00:00:00 2001
From: Andy Wick <andywick@gmail.com>
Date: Thu, 29 Oct 2020 15:24:05 -0400
Subject: [PATCH] fix json parse would always fail 2nd call

---
 capture/plugins/suricata.c | 5 ++++-
 capture/thirdparty/js0n.c  | 4 ++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/capture/plugins/suricata.c b/capture/plugins/suricata.c
index 6dae6fc8fb..4d3f2c610d 100644
--- a/capture/plugins/suricata.c
+++ b/capture/plugins/suricata.c
@@ -286,7 +286,10 @@ LOCAL void suricata_process()
     memset(out, 0, sizeof(out));
     int rc;
     if ((rc = js0n((unsigned char *)line, lineLen, out)) != 0) {
-        LOG("ERROR: Parse error %d >%.*s<\n", rc, lineLen, line);
+        if (rc > 0)
+            LOG("ERROR: Parse error at character pos %d (%c) >%.*s<\n", rc-1, line[rc-1], lineLen, line);
+        else
+            LOG("ERROR: Parse error %d >%.*s<\n", rc, lineLen, line);
         fflush(stdout);
         return;
     }
diff --git a/capture/thirdparty/js0n.c b/capture/thirdparty/js0n.c
index 6f692647f7..4603efac64 100644
--- a/capture/thirdparty/js0n.c
+++ b/capture/thirdparty/js0n.c
@@ -52,7 +52,7 @@ int js0n(unsigned char *js, unsigned int len, unsigned int *out)
 		['"'] = &&l_unesc, ['\\'] = &&l_unesc, ['/'] = &&l_unesc, ['b'] = &&l_unesc,
 		['f'] = &&l_unesc, ['n'] = &&l_unesc, ['r'] = &&l_unesc, ['t'] = &&l_unesc, ['u'] = &&l_unesc
 	};
-	static void **go = gostruct;
+	void **go = gostruct;
 	
 	for(cur=js,end=js+len; cur<end; cur++)
 	{
@@ -63,7 +63,7 @@ int js0n(unsigned char *js, unsigned int len, unsigned int *out)
 	return depth; // 0 if successful full parse, >0 for incomplete data
 	
 	l_bad:
-		return 1;
+		return cur - js + 1;
 	
 	l_up:
 		PUSH(0);