From ad62fa01c7a963c56bac75d8f7db6a5c76be4655 Mon Sep 17 00:00:00 2001
From: Steve Grubb <sgrubb@redhat.com>
Date: Sat, 7 Aug 2021 13:59:40 -0400
Subject: [PATCH 2200/2246] Better fix for busy loop in normalizer when logs
 are corrupt

---
 auparse/normalize.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/auparse/normalize.c b/auparse/normalize.c
index cd0a7c2..0ccabc5 100644
--- a/auparse/normalize.c
+++ b/auparse/normalize.c
@@ -346,10 +346,11 @@ static void collect_id_obj2(auparse_state_t *au, const char *syscall)
 			if ((strcmp(str, "unset") == 0) && errno == 0) {
 				// Only move it if its safe to
 				if (cnt < limit) {
-					auparse_next_field(au);
+					if (auparse_next_field(au) == 0)
+						return;
 					cnt++;
 				} else
-					break;
+					return;
 			} else
 				break;
 		}
-- 
1.8.3.1

