Crash when passing double value in json object for parsing with filterx

[mitzkia]

axosyslog version:

(dbld)micek@DESKTOP-0E9OKG3:/install/sbin$ ./syslog-ng -V
axosyslog 4 (4.8.0.217.g17b1fd8)
Config version: 4.2
Installer-Version: 4.8.0.217.g17b1fd8
Revision:
Compile-Date: Aug 26 2024 05:05:23

Reproduction:
Axosyslog got crashed when started with the following configuration:

@version: 4.2

source genmsg {
    example-msg-generator(
        num(1)
        template("foobar")
        values(
            "values.json" => json('{"ppu": 0.1}'),
        )
    );
};

destination dest_true {
        file (dest-true.log);
};

log {
    source(genmsg);
    if {
        filterx { 
            $envelope = "$(format-json --subkeys values.)";
            $MSG = $envelope.json;
};        
        destination(dest_true);
    };
};

axosyslog start:

[2024-08-31T06:36:57.556436] syslog-ng starting up; version='4.8.0.217.g17b1fd8'
[2024-08-31T06:36:57.556436] Running application hooks; hook='2'
[2024-08-31T06:36:57.556436] Setting value; name='values.json', value='{"ppu": 0.1}', type='json', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Setting value; name='MESSAGE', value='-- Generated message. --', type='string', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Setting value; name='MESSAGE', value='foobar', type='string', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Incoming generated message; msg='foobar'
[2024-08-31T06:36:57.556436] >>>>>> Source side message processing begin; location='aaa.conf:4:5', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Setting value; name='HOST_FROM', value='DESKTOP-0E9OKG3', type='string', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Setting value; name='HOST', value='DESKTOP-0E9OKG3', type='string', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Setting tag; name='.source.genmsg', value='1', msg='0x561579703a50'
[2024-08-31T06:36:57.556436] Setting value; name='SOURCE', value='genmsg', type='string', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] >>>>>> filterx rule evaluation begin; rule='#anon-filter0', location='aaa.conf:20:16', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] FILTERX ESTEP; expr='aaa.conf:21:13|       $envelope = "$(format-json --subkeys values.)"', value='{"json":{"ppu": 0.1}}', truthy='1', type='message_value'
[2024-08-31T06:36:57.556436] FILTERX ESTEP; expr='aaa.conf:22:13|       $MSG = $envelope.json', value='{"ppu":0.10000000000000001}', truthy='1', type='json_object'
[2024-08-31T06:36:57.556436] <<<<<< filterx rule evaluation result; result='matched', rule='#anon-filter0', location='aaa.conf:20:16', dirty='1', msg='0x561579703a50', rcptid='1363'
[2024-08-31T06:36:57.556436] Message was cloned; original_msg='0x561579703a50', msg='0x5615796e0990', rcptid='1363'
[2024-08-31T06:36:57.556436] Filterx sync: changed variable in scope, overwriting in message; variable='MESSAGE'
Segmentation fault

gdb:

Program received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
warning: 76     ../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory
(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x00007ffff7915e77 in json_object_userdata_to_json_string () from /lib/x86_64-linux-gnu/libjson-c.so.5
#2  0x00007ffff7916c2d in ?? () from /lib/x86_64-linux-gnu/libjson-c.so.5
#3  0x00007ffff7916a5f in json_object_to_json_string_length () from /lib/x86_64-linux-gnu/libjson-c.so.5
#4  0x00007ffff7ed850c in _marshal (s=0x555555609510, repr=0x555555608e20, t=0x7fffffffded7 "\001") at /source/lib/filterx/object-json-object.c:53
#5  0x00007ffff7ed6042 in filterx_object_marshal (self=0x555555609510, repr=0x555555608e20, t=0x7fffffffded7 "\001") at /source/lib/filterx/filterx-object.h:165
#6  0x00007ffff7ed6968 in filterx_scope_sync (self=0x555555608f70, msg=0x5555555e5a00) at /source/lib/filterx/filterx-scope.c:331
#7  0x00007ffff7e6825c in filterx_eval_sync_message (context=0x7fffffffe0b0, pmsg=0x7fffffffdf80, path_options=0x7fffffffe090) at /source/lib/filterx/filterx-eval.h:78
#8  0x00007ffff7e6828f in filterx_eval_prepare_for_fork (context=0x7fffffffe0b0, pmsg=0x7fffffffdf80, path_options=0x7fffffffe090) at /source/lib/filterx/filterx-eval.h:84
#9  0x00007ffff7e68782 in log_multiplexer_queue (s=0x555555605240, msg=0x5555555e5a00, path_options=0x7fffffffe090) at /source/lib/logmpx.c:96
#10 0x00007ffff7edf83b in log_pipe_queue (s=0x555555605240, msg=0x555555608a00, path_options=0x7fffffffe090) at /source/lib/logpipe.h:485
#11 0x00007ffff7edf676 in log_pipe_forward_msg (self=0x5555556104a0, msg=0x555555608a00, path_options=0x7fffffffe090) at /source/lib/logpipe.h:439
#12 0x00007ffff7edfb9b in log_filterx_pipe_queue (s=0x5555556104a0, msg=0x555555608a00, path_options=0x7fffffffe090) at /source/lib/filterx/filterx-pipe.c:77
#13 0x00007ffff7e685bb in log_pipe_queue (s=0x5555556104a0, msg=0x555555608a00, path_options=0x7fffffffe1f0) at /source/lib/logpipe.h:485
#14 0x00007ffff7e68820 in log_multiplexer_queue (s=0x5555556057c0, msg=0x555555608a00, path_options=0x7fffffffe3c0) at /source/lib/logmpx.c:115
#15 0x00007ffff7e685bb in log_pipe_queue (s=0x5555556057c0, msg=0x555555608a00, path_options=0x7fffffffe3c0) at /source/lib/logpipe.h:485
#16 0x00007ffff7e683f6 in log_pipe_forward_msg (self=0x555555604b60, msg=0x555555608a00, path_options=0x7fffffffe3c0) at /source/lib/logpipe.h:439
#17 0x00007ffff7e685d4 in log_pipe_queue (s=0x555555604b60, msg=0x555555608a00, path_options=0x7fffffffe3c0) at /source/lib/logpipe.h:489
#18 0x00007ffff7e683f6 in log_pipe_forward_msg (self=0x5555556046c0, msg=0x555555608a00, path_options=0x7fffffffe3c0) at /source/lib/logpipe.h:439
#19 0x00007ffff7e685d4 in log_pipe_queue (s=0x5555556046c0, msg=0x555555608a00, path_options=0x7fffffffe3c0) at /source/lib/logpipe.h:489
#20 0x00007ffff7e68820 in log_multiplexer_queue (s=0x555555604880, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logmpx.c:115
#21 0x00007ffff7e5f050 in log_pipe_queue (s=0x555555604880, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:485
#22 0x00007ffff7e5ee8b in log_pipe_forward_msg (self=0x555555604560, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:439
#23 0x00007ffff7e5f069 in log_pipe_queue (s=0x555555604560, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:489
#24 0x00007ffff7e5ee8b in log_pipe_forward_msg (self=0x555555604410, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:439
#25 0x00007ffff7e5f069 in log_pipe_queue (s=0x555555604410, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:489
#26 0x00007ffff7e5ee8b in log_pipe_forward_msg (self=0x5555555ee700, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:439
#27 0x00007ffff7e5f9e4 in log_src_driver_queue_method (s=0x5555555ee700, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/driver.c:238
#28 0x00007ffff7e6f7f9 in log_pipe_queue (s=0x5555555ee700, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:485
#29 0x00007ffff7e6f634 in log_pipe_forward_msg (self=0x555555606170, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:439
#30 0x00007ffff7e7174e in log_source_queue (s=0x555555606170, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logsource.c:674
#31 0x00007ffff7e6f7f9 in log_pipe_queue (s=0x555555606170, msg=0x555555608a00, path_options=0x7fffffffe730) at /source/lib/logpipe.h:485
#32 0x00007ffff7e71391 in log_source_post (self=0x555555606170, msg=0x555555608a00) at /source/lib/logsource.c:593
#33 0x00007ffff507d5e1 in _send_generated_message (self=0x555555606170) at /source/modules/examples/sources/msg-generator/msg-generator-source.c:131
#34 0x00007ffff507d606 in _timer_expired (cookie=0x555555606170) at /source/modules/examples/sources/msg-generator/msg-generator-source.c:139
#35 0x00007ffff7f34ec4 in iv_run_timers (st=0x555555561960) at /source/lib/ivykis/src/iv_timer.c:124
#36 0x00007ffff7f38266 in iv_main () at /source/lib/ivykis/src/iv_main_posix.c:98
#37 0x00007ffff7e7a500 in main_loop_run (self=0x7ffff7fbc460 <main_loop>) at /source/lib/mainloop.c:763
#38 0x0000555555556aac in main (argc=1, argv=0x7fffffffea18) at /source/syslog-ng/main.c:345