{"record":{"id":"ddc6b004063e5e71","repo":"crowdsecurity/crowdsec","slug":"pri-must-be-up-to-3-characters-long-ddc6b0","errorCode":null,"errorMessage":"PRI must be up to 3 characters long","messagePattern":"PRI must be up to 3 characters long","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go","lineNumber":66,"sourceCode":"\t}\n\n\tr.position++\n\n\tfor r.position < r.len {\n\t\tc := r.buf[r.position]\n\t\tif c == '>' {\n\t\t\tr.position++\n\t\t\tbreak\n\t\t}\n\t\tif c < '0' || c > '9' {\n\t\t\treturn errors.New(\"PRI must be a number\")\n\t\t}\n\t\tpri = pri*10 + int(c-'0')\n\t\tr.position++\n\t}\n\n\tif pri > 999 {\n\t\treturn errors.New(\"PRI must be up to 3 characters long\")\n\t}\n\n\tif r.position == r.len && r.buf[r.position-1] != '>' {\n\t\treturn errors.New(\"PRI must end with '>'\")\n\t}\n\n\tr.PRI = pri\n\treturn nil\n}\n\nfunc (r *RFC5424) parseVersion() error {\n\tif r.buf[r.position] != '1' {\n\t\treturn errors.New(\"version must be 1\")\n\t}\n\tr.position += 2\n\tif r.position >= r.len {\n\t\treturn errors.New(\"version must be followed by a space\")\n\t}","sourceCodeStart":48,"sourceCodeEnd":84,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/syslog/internal/parser/rfc5424/parse.go#L48-L84","documentation":"After consuming PRI digits, parsePRI checks the accumulated numeric value. RFC 5424 PRI is a value 0-999 (facility*8 + severity), so a computed value above 999 means more than 3 digits were supplied and the parser rejects the line. This guards against mis-framed or non-syslog input.","triggerScenarios":"Calling RFC5424.Parse with a PRI of 4+ digits, e.g. \"<1234>1 ...\" — pri accumulates to 1234 which exceeds 999, error returned before the '>' is even reached.","commonSituations":"A buggy sender padding PRI with zeros or emitting a wrong field (e.g. a length prefix parsed as PRI), concatenated syslog frames like \"<12>3<34>1...\" where '3' before '<' would instead hit error 110 — but \"<1234>\" style overflow comes from senders emitting invalid priorities.","solutions":["Fix the emitting device to send PRI as facility*8+severity (0-999) with at most 3 digits.","Verify the line isn't a concatenation of two syslog frames; enforce proper framing (octet counting for TCP per RFC 6587).","Log the raw input to confirm the digits between '<' and '>' and correct the sender configuration."],"exampleFix":"// before\nparser.Parse([]byte(\"<1234>1 2024-01-01T00:00:00Z host app 1 - msg\"))\n// after (PRI = facility*8 + severity, max 999)\nparser.Parse([]byte(\"<165>1 2024-01-01T00:00:00Z host app 1 - msg\"))","handlingStrategy":"validation","validationCode":"// Go: PRI must be 1-3 digits and value <= 999\nfunc priInRange(line []byte) bool {\n\tend := 1\n\tfor end < len(line) && line[end] != '>' {\n\t\tend++\n\t}\n\tif end > 4 || end >= len(line) {\n\t\treturn false\n\t}\n\tpri, err := strconv.Atoi(string(line[1:end]))\n\treturn err == nil && pri >= 0 && pri <= 999\n}","typeGuard":null,"tryCatchPattern":"if err := parser.Parse(line); err != nil {\n\tif strings.Contains(err.Error(), \"up to 3 characters\") {\n\t\t// reject/quarantine the frame; check sender framing\n\t}\n}","preventionTips":["Ensure senders compute PRI as facility*8+severity (0-999)","Use octet-counting framing (RFC 6587) to avoid concatenated frames","Bound-check PRI digits before invoking the parser"],"tags":["syslog","rfc5424","parsing","value-out-of-range"],"backgroundTag":"value-out-of-range","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}