In kernel as well as when parsing, hour_type is assumed to be 32bits. Having the struct datatype field set to 64bits breaks Big Endian and so does passing a 64bit value and 32 as length to constant_expr_alloc() as it makes it import the upper 32bits. Fix this by turning 'result' into a uint32_t and introduce a temporary uint64_t just for the call to time_parse() which expects that. Fixes: f8f32deda31df ("meta: Introduce new conditions 'time', 'day' and 'hour'") Signed-off-by: Phil Sutter <phil@xxxxxx> --- src/meta.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/meta.c b/src/meta.c index 1794495ebba1c..23b1fd2759483 100644 --- a/src/meta.c +++ b/src/meta.c @@ -516,7 +516,8 @@ static struct error_record *hour_type_parse(struct parse_ctx *ctx, { struct error_record *er; struct tm tm, *cur_tm; - uint64_t result = 0; + uint32_t result; + uint64_t tmp; char *endptr; time_t ts; @@ -544,8 +545,8 @@ static struct error_record *hour_type_parse(struct parse_ctx *ctx, if (endptr && *endptr) return error(&sym->location, "Can't parse trailing input: \"%s\"\n", endptr); - if ((er = time_parse(&sym->location, sym->identifier, &result)) == NULL) { - result /= 1000; + if ((er = time_parse(&sym->location, sym->identifier, &tmp)) == NULL) { + result = tmp / 1000; goto convert; } @@ -599,7 +600,7 @@ const struct datatype hour_type = { .name = "hour", .desc = "Hour of day of packet reception", .byteorder = BYTEORDER_HOST_ENDIAN, - .size = sizeof(uint64_t) * BITS_PER_BYTE, + .size = sizeof(uint32_t) * BITS_PER_BYTE, .basetype = &integer_type, .print = hour_type_print, .parse = hour_type_parse, -- 2.33.0