From 2e20195b9965ebe23d3ab49c7183f823c52e509b Mon Sep 17 00:00:00 2001
From: Timothy Stack <timothyshanestack@gmail.com>
Date: Mon, 23 May 2022 21:41:50 -0700
Subject: [PATCH] [afl] some more fixes for fuzzer bugs

Fixes #987
Fixes #986
Fixes #985
Fixes #984
Fixes #982
---
 src/base/intern_string.cc                     | 26 ++++++---
 src/base/intern_string.hh                     |  5 +-
 src/base/intern_string.tests.cc               |  8 +++
 src/base/time_util.hh                         |  4 +-
 src/log_format.cc                             | 17 +++---
 src/log_format_impls.cc                       | 53 ++++++++++---------
 src/pcap_manager.cc                           |  4 +-
 src/tailer/tailer.looper.cc                   |  4 +-
 src/yajl/yajl_encode.c                        | 14 ++---
 src/yajlpp/test_yajlpp.cc                     | 28 ++++++++++
 src/yajlpp/yajlpp.cc                          | 40 ++++++--------
 test/expected/expected.am                     |  8 ++-
 ...731a04c877a34819b35de185e30a74c9fd497.err} |  0
 ...d731a04c877a34819b35de185e30a74c9fd497.out |  3 ++
 ...ba304f34ae07c4fa9e91e0b42f5fe98654a6a8.out |  1 -
 ...a3c49e53c2229a7400c107338fa0bb38375e2.err} |  0
 ...0a3c49e53c2229a7400c107338fa0bb38375e2.out |  1 +
 ...a907fcb069b8d6e65961a7b2e796d6c3a87b1.err} |  0
 ...2a907fcb069b8d6e65961a7b2e796d6c3a87b1.out |  2 +
 ...a3663a45aca6a328cb728872af7ed7ee896f1c.err |  2 -
 ...2ae9244db314a953af2bee969726e381bc5a32.err |  3 --
 ...58f1f011ba8e1b152396c072790c076fdb8ce8.err |  3 --
 ...58f1f011ba8e1b152396c072790c076fdb8ce8.out |  1 -
 ...1af24141680330791db7f7c5fa70833ce08a6b.err |  1 -
 ...1af24141680330791db7f7c5fa70833ce08a6b.out |  0
 ...703b13990785632cca82123fb3883797959c0b.err |  0
 ...703b13990785632cca82123fb3883797959c0b.out |  4 --
 ...6730cac50b4a09b7de4b84641791470b1cb9a3.err |  0
 ...6730cac50b4a09b7de4b84641791470b1cb9a3.out | 10 ----
 ...18474a3e472fff6e23e0c41337ec9188fee591.err | 12 -----
 ...18474a3e472fff6e23e0c41337ec9188fee591.out |  3 --
 ...2cc58676590a3604d5c2183f5fe0a75c98351a.err |  0
 ...2cc58676590a3604d5c2183f5fe0a75c98351a.out |  2 -
 ...6fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.err |  0
 ...6fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.out |  1 -
 ...2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.err |  3 --
 ...2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.out |  0
 ...9bde30483e0a6461076e9058f3a5eb81ae0425.err |  2 -
 ...9bde30483e0a6461076e9058f3a5eb81ae0425.out |  0
 ...0db454054cf92ec9bd0f4e3e83300047f583ff.err |  0
 ...0db454054cf92ec9bd0f4e3e83300047f583ff.out |  4 --
 ...1af6f3d29b8350542d5c6e98bdbf4c223cd531.err |  1 -
 ...1af6f3d29b8350542d5c6e98bdbf4c223cd531.out |  0
 ...91a5b617867cf37c9f7baa85ffa425f7d455a2.err |  3 --
 ...91a5b617867cf37c9f7baa85ffa425f7d455a2.out |  0
 ...ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.err |  0
 ...ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.out |  2 -
 ...e76c174c58d67bf93e8f01d6d55ebb6a023f10.err |  3 --
 ...e76c174c58d67bf93e8f01d6d55ebb6a023f10.out |  0
 ...43e6657d4f60e68d31eb8302542ca28e80d077.err |  0
 ...43e6657d4f60e68d31eb8302542ca28e80d077.out |  2 -
 ...93a3b6b941847c71409a297779fbb0a6666a51.err |  5 --
 ...93a3b6b941847c71409a297779fbb0a6666a51.out |  0
 ...c56a9d146ec9a7c2196559d316f928b2ae6ae9.err |  4 --
 ...c56a9d146ec9a7c2196559d316f928b2ae6ae9.out |  0
 ...101ee29c45cdb8c0f117ad736c9a5dd5da5839.err |  1 -
 ...101ee29c45cdb8c0f117ad736c9a5dd5da5839.out |  0
 ...3e07df9b3068696fdc8759c7561135db981b38.err |  2 -
 ...3e07df9b3068696fdc8759c7561135db981b38.out |  0
 ...d859487e4ea011cd6e0f0f114d70158bfd8b43.err |  0
 ...d859487e4ea011cd6e0f0f114d70158bfd8b43.out | 37 -------------
 ...6c0a9f0f04e24ce1fae7a0a434830b14447f83.err |  1 -
 ...6c0a9f0f04e24ce1fae7a0a434830b14447f83.out |  0
 ...4597760285c3964b258726341e018f6cd49954.err |  5 --
 ...4597760285c3964b258726341e018f6cd49954.out |  0
 ...3e393dbf23d0d8e276e9b7610c7b74d79980f8.err |  0
 ...3e393dbf23d0d8e276e9b7610c7b74d79980f8.out | 15 ------
 ...41b6ee90cbf038620151f16d164b361acf82dd.err |  1 -
 ...41b6ee90cbf038620151f16d164b361acf82dd.out |  0
 ...abaa610808635cebb8031a686274d44fcae1b3.err |  0
 ...abaa610808635cebb8031a686274d44fcae1b3.out |  5 --
 ...9647b59b4fec38734fa58842c0e720c21af120.err |  0
 ...9647b59b4fec38734fa58842c0e720c21af120.out |  2 -
 test/test_logfile.sh                          | 15 ++++++
 74 files changed, 151 insertions(+), 222 deletions(-)
 rename test/expected/{test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.err => test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.err} (100%)
 create mode 100644 test/expected/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.out
 delete mode 100644 test/expected/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.out
 rename test/expected/{test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.out => test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.err} (100%)
 create mode 100644 test/expected/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.out
 rename test/expected/{test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.out => test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.err} (100%)
 create mode 100644 test/expected/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.out
 delete mode 100644 test/expected/test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.err
 delete mode 100644 test/expected/test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.err
 delete mode 100644 test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.err
 delete mode 100644 test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.out
 delete mode 100644 test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.err
 delete mode 100644 test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.out
 delete mode 100644 test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.err
 delete mode 100644 test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.out
 delete mode 100644 test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.err
 delete mode 100644 test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.out
 delete mode 100644 test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.err
 delete mode 100644 test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.out
 delete mode 100644 test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.err
 delete mode 100644 test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.out
 delete mode 100644 test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.err
 delete mode 100644 test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.out
 delete mode 100644 test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.err
 delete mode 100644 test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.out
 delete mode 100644 test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.err
 delete mode 100644 test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.out
 delete mode 100644 test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.err
 delete mode 100644 test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.out
 delete mode 100644 test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.err
 delete mode 100644 test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.out
 delete mode 100644 test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.err
 delete mode 100644 test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.out
 delete mode 100644 test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.err
 delete mode 100644 test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.out
 delete mode 100644 test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.err
 delete mode 100644 test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.out
 delete mode 100644 test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.err
 delete mode 100644 test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.out
 delete mode 100644 test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.err
 delete mode 100644 test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.out
 delete mode 100644 test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.err
 delete mode 100644 test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.out
 delete mode 100644 test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.err
 delete mode 100644 test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.out
 delete mode 100644 test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.err
 delete mode 100644 test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.out
 delete mode 100644 test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.err
 delete mode 100644 test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.out
 delete mode 100644 test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.err
 delete mode 100644 test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.out
 delete mode 100644 test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.err
 delete mode 100644 test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.out
 delete mode 100644 test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.err
 delete mode 100644 test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.out
 delete mode 100644 test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.err
 delete mode 100644 test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.out
 delete mode 100644 test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.err
 delete mode 100644 test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.out
 delete mode 100644 test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.err
 delete mode 100644 test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.out

diff --git a/src/base/intern_string.cc b/src/base/intern_string.cc
index 78b976d8..8a842b05 100644
--- a/src/base/intern_string.cc
+++ b/src/base/intern_string.cc
@@ -137,14 +137,16 @@ intern_string::startswith(const char* prefix) const
     return *prefix == '\0';
 }
 
-void
-string_fragment::trim(const char* tokens)
+string_fragment
+string_fragment::trim(const char* tokens) const
 {
-    while (this->sf_begin < this->sf_end) {
+    string_fragment retval = *this;
+
+    while (retval.sf_begin < retval.sf_end) {
         bool found = false;
 
         for (int lpc = 0; tokens[lpc] != '\0'; lpc++) {
-            if (this->sf_string[this->sf_begin] == tokens[lpc]) {
+            if (retval.sf_string[retval.sf_begin] == tokens[lpc]) {
                 found = true;
                 break;
             }
@@ -153,13 +155,13 @@ string_fragment::trim(const char* tokens)
             break;
         }
 
-        this->sf_begin += 1;
+        retval.sf_begin += 1;
     }
-    while (this->sf_begin < this->sf_end) {
+    while (retval.sf_begin < retval.sf_end) {
         bool found = false;
 
         for (int lpc = 0; tokens[lpc] != '\0'; lpc++) {
-            if (this->sf_string[this->sf_end - 1] == tokens[lpc]) {
+            if (retval.sf_string[retval.sf_end - 1] == tokens[lpc]) {
                 found = true;
                 break;
             }
@@ -168,8 +170,16 @@ string_fragment::trim(const char* tokens)
             break;
         }
 
-        this->sf_end -= 1;
+        retval.sf_end -= 1;
     }
+
+    return retval;
+}
+
+string_fragment
+string_fragment::trim() const
+{
+    return this->trim(" \t\r\n");
 }
 
 nonstd::optional<string_fragment>
diff --git a/src/base/intern_string.hh b/src/base/intern_string.hh
index 52ef80b5..52e903bb 100644
--- a/src/base/intern_string.hh
+++ b/src/base/intern_string.hh
@@ -145,7 +145,7 @@ struct string_fragment {
     {
         const auto* iter = this->begin();
 
-        while (*prefix != '\0' && *prefix == *iter && iter < this->end()) {
+        while (*prefix != '\0' && iter < this->end() && *prefix == *iter) {
             prefix += 1;
             iter += 1;
         }
@@ -296,7 +296,8 @@ struct string_fragment {
         this->sf_end = -1;
     }
 
-    void trim(const char* tokens);
+    string_fragment trim(const char* tokens) const;
+    string_fragment trim() const;
 
     string_fragment prepend(const char* str, int amount) const
     {
diff --git a/src/base/intern_string.tests.cc b/src/base/intern_string.tests.cc
index 82e6c5b0..97d09c59 100644
--- a/src/base/intern_string.tests.cc
+++ b/src/base/intern_string.tests.cc
@@ -35,6 +35,14 @@
 #include "config.h"
 #include "doctest/doctest.h"
 
+TEST_CASE("string_fragment::startswith")
+{
+    std::string empty;
+    auto sf = string_fragment{empty};
+
+    CHECK_FALSE(sf.startswith("abc"));
+}
+
 TEST_CASE("split_lines")
 {
     std::string in1 = "Hello, World!";
diff --git a/src/base/time_util.hh b/src/base/time_util.hh
index 49461f2f..713640c1 100644
--- a/src/base/time_util.hh
+++ b/src/base/time_util.hh
@@ -92,7 +92,7 @@ enum exttm_flags_t {
 };
 
 struct exttm {
-    struct tm et_tm;
+    struct tm et_tm {};
     int32_t et_nsec{0};
     unsigned int et_flags{0};
     long et_gmtoff{0};
@@ -105,7 +105,7 @@ struct exttm {
     bool operator==(const exttm& other) const
     {
         return memcmp(this, &other, sizeof(exttm)) == 0;
-    };
+    }
 
     struct timeval to_timeval() const;
 };
diff --git a/src/log_format.cc b/src/log_format.cc
index 5d2b8761..c9e7dc02 100644
--- a/src/log_format.cc
+++ b/src/log_format.cc
@@ -387,14 +387,20 @@ log_format::check_for_new_year(std::vector<logline>& dst,
         struct tm otm;
 
         gmtime_r(&ot, &otm);
-        otm.tm_year -= off_year;
+        if (otm.tm_year < off_year) {
+            otm.tm_year = 0;
+        } else {
+            otm.tm_year -= off_year;
+        }
         otm.tm_mon -= off_month;
-        otm.tm_mday -= off_day;
-        otm.tm_hour -= off_hour;
+        if (otm.tm_mon < 0) {
+            otm.tm_mon += 12;
+        }
         auto new_time = tm2sec(&otm);
         if (new_time == -1) {
             continue;
         }
+        new_time -= (off_day * 24 * 60 * 60) + (off_hour * 60 * 60);
         ll.set_time(new_time);
     }
 }
@@ -403,10 +409,7 @@ log_format::check_for_new_year(std::vector<logline>& dst,
  * XXX This needs some cleanup.
  */
 struct json_log_userdata {
-    json_log_userdata(shared_buffer_ref& sbr)
-        : jlu_shared_buffer(sbr){
-
-        };
+    json_log_userdata(shared_buffer_ref& sbr) : jlu_shared_buffer(sbr) {}
 
     external_log_format* jlu_format{nullptr};
     const logline* jlu_line{nullptr};
diff --git a/src/log_format_impls.cc b/src/log_format_impls.cc
index 1f025733..4d8d29aa 100644
--- a/src/log_format_impls.cc
+++ b/src/log_format_impls.cc
@@ -388,13 +388,12 @@ public:
     struct field_def {
         logline_value_meta fd_meta;
         std::string fd_collator;
-        int fd_numeric_index;
+        nonstd::optional<size_t> fd_numeric_index;
 
         explicit field_def(const intern_string_t name,
                            int col,
                            log_format* format)
-            : fd_meta(name, value_kind_t::VALUE_TEXT, col, format),
-              fd_numeric_index(-1)
+            : fd_meta(name, value_kind_t::VALUE_TEXT, col, format)
         {
         }
 
@@ -408,7 +407,7 @@ public:
             return *this;
         }
 
-        field_def& with_numeric_index(int index)
+        field_def& with_numeric_index(size_t index)
         {
             this->fd_numeric_index = index;
             return *this;
@@ -484,7 +483,7 @@ public:
                 opid = hash_str(sf.data(), sf.length());
             }
 
-            if (fd.fd_numeric_index >= 0) {
+            if (fd.fd_numeric_index) {
                 switch (fd.fd_meta.lvm_kind) {
                     case value_kind_t::VALUE_INTEGER:
                     case value_kind_t::VALUE_FLOAT: {
@@ -494,8 +493,8 @@ public:
 
                         if (sscanf(sf.to_string(field_copy), "%lf", &val) == 1)
                         {
-                            this->lf_value_stats[fd.fd_numeric_index].add_value(
-                                val);
+                            this->lf_value_stats[fd.fd_numeric_index.value()]
+                                .add_value(val);
                         }
                         break;
                     }
@@ -583,7 +582,7 @@ public:
             } else if (directive == "#path") {
                 auto full_name = fmt::format(FMT_STRING("bro_{}_log"), *iter);
                 this->blf_format_name = intern_string::lookup(full_name);
-            } else if (directive == "#fields") {
+            } else if (directive == "#fields" && this->blf_field_defs.empty()) {
                 do {
                     this->blf_field_defs.emplace_back(
                         intern_string::lookup("bro_" + sql_safe_ident(*iter)),
@@ -715,10 +714,11 @@ public:
 
         for (const auto& blf_field_def : this->blf_field_defs) {
             if (blf_field_def.fd_meta.lvm_name == name) {
-                if (blf_field_def.fd_numeric_index < 0) {
+                if (!blf_field_def.fd_numeric_index) {
                     break;
                 }
-                retval = &this->lf_value_stats[blf_field_def.fd_numeric_index];
+                retval = &this->lf_value_stats[blf_field_def.fd_numeric_index
+                                                   .value()];
                 break;
             }
         }
@@ -911,16 +911,17 @@ public:
         const intern_string_t fd_name;
         logline_value_meta fd_meta;
         std::string fd_collator;
-        int fd_numeric_index;
+        nonstd::optional<size_t> fd_numeric_index;
 
         explicit field_def(const intern_string_t name)
             : fd_name(name), fd_meta(intern_string::lookup(sql_safe_ident(
                                          name.to_string_fragment())),
-                                     value_kind_t::VALUE_TEXT),
-              fd_numeric_index(-1){};
+                                     value_kind_t::VALUE_TEXT)
+        {
+        }
 
         field_def(const intern_string_t name, logline_value_meta meta)
-            : fd_name(name), fd_meta(meta), fd_numeric_index(-1)
+            : fd_name(name), fd_meta(meta)
         {
         }
 
@@ -934,7 +935,7 @@ public:
                   intern_string::lookup(sql_safe_ident(string_fragment(name))),
                   kind,
                   col),
-              fd_collator(std::move(coll)), fd_numeric_index(-1)
+              fd_collator(std::move(coll))
         {
             this->fd_meta.lvm_identifier = ident;
         }
@@ -1031,12 +1032,11 @@ public:
                         = sbr.to_string_fragment().consume_n(sf.length());
 
                     if (sbr_sf_opt) {
-                        auto sbr_sf = sbr_sf_opt.value();
+                        auto sbr_sf = sbr_sf_opt.value().trim();
                         date_time_scanner dts;
                         struct exttm tm;
                         struct timeval tv;
 
-                        sbr_sf.trim(" \t");
                         if (dts.scan(sbr_sf.data(),
                                      sbr_sf.length(),
                                      nullptr,
@@ -1052,7 +1052,7 @@ public:
                 return SCAN_MATCH;
             }
 
-            sf.trim("\" \t");
+            sf = sf.trim("\" \t");
             if (F_DATE == fd.fd_name || F_DATE_LOCAL == fd.fd_name
                 || F_DATE_UTC == fd.fd_name)
             {
@@ -1076,7 +1076,7 @@ public:
                 }
             }
 
-            if (fd.fd_numeric_index >= 0) {
+            if (fd.fd_numeric_index) {
                 switch (fd.fd_meta.lvm_kind) {
                     case value_kind_t::VALUE_INTEGER:
                     case value_kind_t::VALUE_FLOAT: {
@@ -1085,8 +1085,8 @@ public:
 
                         if (sscanf(sf.to_string(field_copy), "%lf", &val) == 1)
                         {
-                            this->lf_value_stats[fd.fd_numeric_index].add_value(
-                                val);
+                            this->lf_value_stats[fd.fd_numeric_index.value()]
+                                .add_value(val);
                         }
                         break;
                     }
@@ -1179,13 +1179,13 @@ public:
                     this->lf_date_time.set_base_time(tv.tv_sec);
                     this->wlf_time_scanner.set_base_time(tv.tv_sec);
                 }
-            } else if (directive == "#Fields:") {
+            } else if (directive == "#Fields:" && this->wlf_field_defs.empty())
+            {
                 int numeric_count = 0;
 
                 do {
-                    string_fragment sf = *iter;
+                    auto sf = (*iter).trim(")");
 
-                    sf.trim(")");
                     auto field_iter = std::find_if(
                         begin(KNOWN_FIELDS),
                         end(KNOWN_FIELDS),
@@ -1308,10 +1308,11 @@ public:
 
         for (const auto& wlf_field_def : this->wlf_field_defs) {
             if (wlf_field_def.fd_meta.lvm_name == name) {
-                if (wlf_field_def.fd_numeric_index < 0) {
+                if (!wlf_field_def.fd_numeric_index) {
                     break;
                 }
-                retval = &this->lf_value_stats[wlf_field_def.fd_numeric_index];
+                retval = &this->lf_value_stats[wlf_field_def.fd_numeric_index
+                                                   .value()];
                 break;
             }
         }
diff --git a/src/pcap_manager.cc b/src/pcap_manager.cc
index 54449319..dbe304ae 100644
--- a/src/pcap_manager.cc
+++ b/src/pcap_manager.cc
@@ -110,8 +110,8 @@ convert(const std::string& filename)
                     lb.read_range(li.li_file_range)
                         .then([error_queue, child_pid](auto sbr) {
                             auto line_str = string_fragment(
-                                sbr.get_data(), 0, sbr.length());
-                            line_str.trim("\n");
+                                                sbr.get_data(), 0, sbr.length())
+                                                .trim("\n");
                             if (error_queue->size() < 5) {
                                 error_queue->emplace_back(line_str.to_string());
                             }
diff --git a/src/tailer/tailer.looper.cc b/src/tailer/tailer.looper.cc
index 4d678969..e7664444 100644
--- a/src/tailer/tailer.looper.cc
+++ b/src/tailer/tailer.looper.cc
@@ -73,8 +73,8 @@ read_err_pipe(const std::string& netloc,
             } else {
                 lb.read_range(li.li_file_range).then([netloc, &eq](auto sbr) {
                     auto line_str
-                        = string_fragment(sbr.get_data(), 0, sbr.length());
-                    line_str.trim("\n");
+                        = string_fragment(sbr.get_data(), 0, sbr.length())
+                              .trim("\n");
                     if (eq.size() < 10) {
                         eq.template emplace_back(line_str.to_string());
                     }
diff --git a/src/yajl/yajl_encode.c b/src/yajl/yajl_encode.c
index fd082581..db859a21 100644
--- a/src/yajl/yajl_encode.c
+++ b/src/yajl/yajl_encode.c
@@ -117,7 +117,7 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
                         size_t len)
 {
     size_t beg = 0;
-    size_t end = 0;    
+    size_t end = 0;
 
     while (end < len) {
         if (str[end] == '\\') {
@@ -139,14 +139,14 @@ void yajl_string_decode(yajl_buf buf, const unsigned char * str,
                     end+=3;
                     /* check if this is a surrogate */
                     if ((codepoint & 0xFC00) == 0xD800) {
-                        end++;
-                        if (str[end] == '\\' && str[end + 1] == 'u') {
+                        if (str[end + 1] == '\\' && str[end + 2] == 'u') {
+                            end += 1;
                             unsigned int surrogate = 0;
                             hexToDigit(&surrogate, str + end + 2);
-                            codepoint =
-                                (((codepoint & 0x3F) << 10) | 
-                                 ((((codepoint >> 6) & 0xF) + 1) << 16) | 
-                                 (surrogate & 0x3FF));
+                            codepoint
+                                = (((codepoint & 0x3F) << 10)
+                                   | ((((codepoint >> 6) & 0xF) + 1) << 16)
+                                   | (surrogate & 0x3FF));
                             end += 5;
                         } else {
                             unescaped = "?";
diff --git a/src/yajlpp/test_yajlpp.cc b/src/yajlpp/test_yajlpp.cc
index 31dc75f8..888684ad 100644
--- a/src/yajlpp/test_yajlpp.cc
+++ b/src/yajlpp/test_yajlpp.cc
@@ -62,11 +62,39 @@ read_const(yajlpp_parse_context* ypc, long long value)
     return 1;
 }
 
+static int
+dummy_string_handler(void* ctx, const unsigned char* s, size_t len)
+{
+    return 1;
+}
+
 int
 main(int argc, char* argv[])
 {
     static const auto TEST_SRC = intern_string::lookup("test_data");
 
+    {
+        struct dummy {};
+
+        typed_json_path_container<dummy> dummy_handlers = {
+
+        };
+
+        std::string in1 = "{\"#\":{\"";
+        auto parse_res = dummy_handlers.parser_for(TEST_SRC).of(in1);
+    }
+
+    {
+        static const char UNICODE_BARF[] = "\"\\udb00\\\\0\"\n";
+
+        yajl_callbacks cbs;
+        memset(&cbs, 0, sizeof(cbs));
+        cbs.yajl_string = dummy_string_handler;
+        auto handle = yajl_alloc(&cbs, nullptr, nullptr);
+        auto rc = yajl_parse(handle, (const unsigned char*) UNICODE_BARF, 12);
+        assert(rc == yajl_status_ok);
+    }
+
     struct json_path_container test_obj_handler = {
         json_path_handler("foo", read_foo),
     };
diff --git a/src/yajlpp/yajlpp.cc b/src/yajlpp/yajlpp.cc
index fb8c4533..63cb4011 100644
--- a/src/yajlpp/yajlpp.cc
+++ b/src/yajlpp/yajlpp.cc
@@ -512,30 +512,24 @@ yajlpp_parse_context::map_key(void* ctx, const unsigned char* key, size_t len)
     if (ypc->ypc_path.back() != '/') {
         ypc->ypc_path.push_back('/');
     }
-    if (ypc->ypc_handlers != nullptr) {
-        for (size_t lpc = 0; lpc < len; lpc++) {
-            switch (key[lpc]) {
-                case '~':
-                    ypc->ypc_path.push_back('~');
-                    ypc->ypc_path.push_back('0');
-                    break;
-                case '/':
-                    ypc->ypc_path.push_back('~');
-                    ypc->ypc_path.push_back('1');
-                    break;
-                case '#':
-                    ypc->ypc_path.push_back('~');
-                    ypc->ypc_path.push_back('2');
-                    break;
-                default:
-                    ypc->ypc_path.push_back(key[lpc]);
-                    break;
-            }
+    for (size_t lpc = 0; lpc < len; lpc++) {
+        switch (key[lpc]) {
+            case '~':
+                ypc->ypc_path.push_back('~');
+                ypc->ypc_path.push_back('0');
+                break;
+            case '/':
+                ypc->ypc_path.push_back('~');
+                ypc->ypc_path.push_back('1');
+                break;
+            case '#':
+                ypc->ypc_path.push_back('~');
+                ypc->ypc_path.push_back('2');
+                break;
+            default:
+                ypc->ypc_path.push_back(key[lpc]);
+                break;
         }
-    } else {
-        size_t start = ypc->ypc_path.size();
-        ypc->ypc_path.resize(ypc->ypc_path.size() + len);
-        memcpy(&ypc->ypc_path[start], key, len);
     }
     ypc->ypc_path.push_back('\0');
 
diff --git a/test/expected/expected.am b/test/expected/expected.am
index 3ced1dbc..9da0d8af 100644
--- a/test/expected/expected.am
+++ b/test/expected/expected.am
@@ -254,10 +254,14 @@ EXPECTED_FILES = \
     $(srcdir)/%reldir%/test_json_format.sh_c60050b3469f37c5b0864e1dc7eb354e91d6ec81.out \
     $(srcdir)/%reldir%/test_json_format.sh_fe19b7ebd349cd689b3f5c22618eab5ce995e68e.err \
     $(srcdir)/%reldir%/test_json_format.sh_fe19b7ebd349cd689b3f5c22618eab5ce995e68e.out \
+    $(srcdir)/%reldir%/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.err \
+    $(srcdir)/%reldir%/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.out \
     $(srcdir)/%reldir%/test_logfile.sh_09bd16e044302f6b121092534708594bdad11b5a.err \
     $(srcdir)/%reldir%/test_logfile.sh_09bd16e044302f6b121092534708594bdad11b5a.out \
-    $(srcdir)/%reldir%/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.err \
-    $(srcdir)/%reldir%/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.out \
+    $(srcdir)/%reldir%/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.err \
+    $(srcdir)/%reldir%/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.out \
+    $(srcdir)/%reldir%/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.err \
+    $(srcdir)/%reldir%/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.out \
     $(srcdir)/%reldir%/test_logfile.sh_a7037efd0c4bbf51940137a44e57d94e9307e83e.err \
     $(srcdir)/%reldir%/test_logfile.sh_a7037efd0c4bbf51940137a44e57d94e9307e83e.out \
     $(srcdir)/%reldir%/test_logfile.sh_c18e14a26d8261c9f72747118a469266121d5459.err \
diff --git a/test/expected/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.err b/test/expected/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.err
similarity index 100%
rename from test/expected/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.err
rename to test/expected/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.err
diff --git a/test/expected/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.out b/test/expected/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.out
new file mode 100644
index 00000000..9b2a7cd8
--- /dev/null
+++ b/test/expected/test_logfile.sh_08d731a04c877a34819b35de185e30a74c9fd497.out
@@ -0,0 +1,3 @@
+2600-12-03 09:23:00.000000 0:
+2600-12-03 09:23:00.000000 0:
+2600-12-03 09:23:00.000000 0:
diff --git a/test/expected/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.out b/test/expected/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.out
deleted file mode 100644
index 9c051e92..00000000
--- a/test/expected/test_logfile.sh_0bba304f34ae07c4fa9e91e0b42f5fe98654a6a8.out
+++ /dev/null
@@ -1 +0,0 @@
-1970-01-01 00:00:00.000000
diff --git a/test/expected/test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.out b/test/expected/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.err
similarity index 100%
rename from test/expected/test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.out
rename to test/expected/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.err
diff --git a/test/expected/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.out b/test/expected/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.out
new file mode 100644
index 00000000..573541ac
--- /dev/null
+++ b/test/expected/test_logfile.sh_290a3c49e53c2229a7400c107338fa0bb38375e2.out
@@ -0,0 +1 @@
+0
diff --git a/test/expected/test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.out b/test/expected/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.err
similarity index 100%
rename from test/expected/test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.out
rename to test/expected/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.err
diff --git a/test/expected/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.out b/test/expected/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.out
new file mode 100644
index 00000000..36b8c5a8
--- /dev/null
+++ b/test/expected/test_logfile.sh_4a2a907fcb069b8d6e65961a7b2e796d6c3a87b1.out
@@ -0,0 +1,2 @@
+	0 #
+0
diff --git a/test/expected/test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.err b/test/expected/test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.err
deleted file mode 100644
index 219e1cd4..00000000
--- a/test/expected/test_regex101.sh_0fa3663a45aca6a328cb728872af7ed7ee896f1c.err
+++ /dev/null
@@ -1,2 +0,0 @@
-✘ error: regex “std” of format “syslog_log” has not been pushed to regex101.com
- = help: use the “push” subcommand to create the regex on regex101.com for easy editing
diff --git a/test/expected/test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.err b/test/expected/test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.err
deleted file mode 100644
index dd9ef1ed..00000000
--- a/test/expected/test_regex101.sh_182ae9244db314a953af2bee969726e381bc5a32.err
+++ /dev/null
@@ -1,3 +0,0 @@
-✘ error: unable to import: https://regex101.com/r/zpEnjV/1
- reason: format file already exists: regex101-home/.lnav/formats/installed/unit_test_log.json
- = help: delete the existing file to continue
diff --git a/test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.err b/test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.err
deleted file mode 100644
index bbcd290b..00000000
--- a/test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.err
+++ /dev/null
@@ -1,3 +0,0 @@
-⚠ warning: not deleting regex101 entry “zpEnjV”
-   reason: delete code is not known for this entry
- =   note: formats created by importing a regex101.com entry will not have a delete code
diff --git a/test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.out b/test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.out
deleted file mode 100644
index bb52e200..00000000
--- a/test/expected/test_regex101.sh_2158f1f011ba8e1b152396c072790c076fdb8ce8.out
+++ /dev/null
@@ -1 +0,0 @@
-✔ deleted regex101 entry: zpEnjV
diff --git a/test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.err b/test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.err
deleted file mode 100644
index 0cbbb166..00000000
--- a/test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.err
+++ /dev/null
@@ -1 +0,0 @@
-✘ error: expecting a regex101.com URL to import
diff --git a/test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.out b/test/expected/test_regex101.sh_281af24141680330791db7f7c5fa70833ce08a6b.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.err b/test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.out b/test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.out
deleted file mode 100644
index a56e5493..00000000
--- a/test/expected/test_regex101.sh_35703b13990785632cca82123fb3883797959c0b.out
+++ /dev/null
@@ -1,4 +0,0 @@
-✔ converted regex101 entry to format file: regex101-home/.lnav/formats/installed/unit_test_log.json
- = note: the converted format may still have errors
- = help: use the following command to patch the regex as more changes are made on regex101.com:
-            lnav -m format unit_test_log regex std regex101 pull
diff --git a/test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.err b/test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.out b/test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.out
deleted file mode 100644
index 7f5397dd..00000000
--- a/test/expected/test_regex101.sh_366730cac50b4a09b7de4b84641791470b1cb9a3.out
+++ /dev/null
@@ -1,10 +0,0 @@
-{
-    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
-    "unit_test_log": {
-        "regex": {
-            "std": {
-                "pattern": "\\[(?<timestamp>\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+) (?<jobserver>[\\w.]+) (?<workqueue>[\\w.]+) (?<processid>\\d+)\\] (?<body>.*)$"
-            }
-        }
-    }
-}
diff --git a/test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.err b/test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.err
deleted file mode 100644
index c6c12f47..00000000
--- a/test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.err
+++ /dev/null
@@ -1,12 +0,0 @@
-✘ error: invalid sample log message: "[03/22/2021 02:00:02 job1074.example.com db.db81.example_events 54026] {\"ELAPSED\":\"0.011\",\"LEVEL\":\"info\",\"MESSAGE\":\"finished in 0.011\\n\",\"PREFIX\":\"YFgyWQriCmsAAofJAAAAHg\",\"ROUTINGKEY\":\"EXAMPLE1366.Example.Events._Publish\"}"
- reason: sample does not match any patterns
- --> regex101-home/.lnav/formats/installed/unit_test_log.json:29
- = note: the following shows how each pattern matched this sample:
-            [03/22/2021 02:00:02 job1074.example.com db.db81.example_events 54026] {"ELAPSED":"0.011","LEVEL":"info","MESSAGE":"finished in 0.011\n","PREFIX":"YFgyWQriCmsAAofJAAAAHg","ROUTINGKEY":"EXAMPLE1366.Example.Events._Publish"}
- = note: std = “”
-✘ error: invalid sample log message: "[03/22/2021 02:00:02 job1074.example.com db.db81.example_events 54026] {\"ELAPSED\":\"0.011\",\"LEVEL\":\"info\",\"MESSAGE\":\"finished in 0.011\\n\",\"PREFIX\":\"YFgyWQriCmsAAofJAAAAHg\",\"ROUTINGKEY\":\"EXAMPLE1366.Example.Events._Publish\"}"
- reason: sample does not match any patterns
- --> regex101-home/.lnav/formats/installed/unit_test_log.json:33
- = note: the following shows how each pattern matched this sample:
-            [03/22/2021 02:00:02 job1074.example.com db.db81.example_events 54026] {"ELAPSED":"0.011","LEVEL":"info","MESSAGE":"finished in 0.011\n","PREFIX":"YFgyWQriCmsAAofJAAAAHg","ROUTINGKEY":"EXAMPLE1366.Example.Events._Publish"}
- = note: std = “”
diff --git a/test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.out b/test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.out
deleted file mode 100644
index 93cf6b49..00000000
--- a/test/expected/test_regex101.sh_3d18474a3e472fff6e23e0c41337ec9188fee591.out
+++ /dev/null
@@ -1,3 +0,0 @@
-✔ format patch file written to: regex101-home/.lnav/formats/installed/unit_test_log.regex101-zpEnjV.json
- = help: once the regex has been found to be working correctly, move the contents of the patch file to the original file at:
-            regex101-home/.lnav/formats/installed/unit_test_log.json
diff --git a/test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.err b/test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.out b/test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.out
deleted file mode 100644
index 7329b20f..00000000
--- a/test/expected/test_regex101.sh_442cc58676590a3604d5c2183f5fe0a75c98351a.out
+++ /dev/null
@@ -1,2 +0,0 @@
-regex101-home/.lnav/formats/installed/unit_test_log.json
-regex101-home/.lnav/formats/installed/unit_test_log.regex101-zpEnjV.json
diff --git a/test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.err b/test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.out b/test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.out
deleted file mode 100644
index 3fd83a6b..00000000
--- a/test/expected/test_regex101.sh_566fd88d216a44bc1c6e23f2d6f2d0caf99d42f9.out
+++ /dev/null
@@ -1 +0,0 @@
-✔ no regex101 entries found
diff --git a/test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.err b/test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.err
deleted file mode 100644
index 7e6dd2fa..00000000
--- a/test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.err
+++ /dev/null
@@ -1,3 +0,0 @@
-✘ error: cannot delete regex101 entry while patch file exists
- = note:   regex101-home/.lnav/formats/installed/unit_test_log.regex101-zpEnjV.json
- = help: move the contents of the patch file to the main log format and then delete the file to continue
diff --git a/test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.out b/test/expected/test_regex101.sh_5f2f7ecb6ab9cbec4b41385b91bd038906b8a7b2.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.err b/test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.err
deleted file mode 100644
index a2d57e69..00000000
--- a/test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.err
+++ /dev/null
@@ -1,2 +0,0 @@
-✘ error: invalid regex “abc(def)” from “https://regex101.com/r/cvCJNP/1”
- reason: only the “pcre” flavor of regexes are supported
diff --git a/test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.out b/test/expected/test_regex101.sh_629bde30483e0a6461076e9058f3a5eb81ae0425.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.err b/test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.out b/test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.out
deleted file mode 100644
index 8b0d55d9..00000000
--- a/test/expected/test_regex101.sh_630db454054cf92ec9bd0f4e3e83300047f583ff.out
+++ /dev/null
@@ -1,4 +0,0 @@
-✔ converted regex101 entry to format file: regex101-home/.lnav/formats/installed/unit_test_log.regex101-hGiqBL.json
- = note: the converted format may still have errors
- = help: use the following command to patch the regex as more changes are made on regex101.com:
-            lnav -m format unit_test_log regex alt regex101 pull
diff --git a/test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.err b/test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.err
deleted file mode 100644
index 96319c92..00000000
--- a/test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.err
+++ /dev/null
@@ -1 +0,0 @@
-✘ error: unknown regex: non-existent
diff --git a/test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.out b/test/expected/test_regex101.sh_771af6f3d29b8350542d5c6e98bdbf4c223cd531.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.err b/test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.err
deleted file mode 100644
index bd3f5785..00000000
--- a/test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.err
+++ /dev/null
@@ -1,3 +0,0 @@
-✘ error: expecting an operation to perform on the std regex
- = help: the available subcommands are:
-          • regex101: use regex101.com to edit this regular expression
diff --git a/test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.out b/test/expected/test_regex101.sh_7991a5b617867cf37c9f7baa85ffa425f7d455a2.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.err b/test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.out b/test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.out
deleted file mode 100644
index 4985cf66..00000000
--- a/test/expected/test_regex101.sh_79ee3f5fe71ccec97b2619d8c1f74ca97ffd2243.out
+++ /dev/null
@@ -1,2 +0,0 @@
-✔ local regex is in sync with entry “zpEnjV” on regex101.com
- = help: make edits on “https://regex101.com/r/zpEnjV” and then run this command again to update the local values
diff --git a/test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.err b/test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.err
deleted file mode 100644
index 99d54b9f..00000000
--- a/test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.err
+++ /dev/null
@@ -1,3 +0,0 @@
-✘ error: unknown regex: s
- = note: did you mean one of the following?
-            std
diff --git a/test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.out b/test/expected/test_regex101.sh_7de76c174c58d67bf93e8f01d6d55ebb6a023f10.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.err b/test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.out b/test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.out
deleted file mode 100644
index 8f4565ab..00000000
--- a/test/expected/test_regex101.sh_8a43e6657d4f60e68d31eb8302542ca28e80d077.out
+++ /dev/null
@@ -1,2 +0,0 @@
-✔ the following regex101 entries were found:
-   format unit_test_log regex std regex101
diff --git a/test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.err b/test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.err
deleted file mode 100644
index 443d00cb..00000000
--- a/test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.err
+++ /dev/null
@@ -1,5 +0,0 @@
-✘ error: expecting an operation to perform on the std regular expression using regex101.com
- = help: the available subcommands are:
-          • push: create/update an entry for this regex on regex101.com
-          • pull: create a patch format file for this regular expression based on the entry in regex101.com
-          • delete: delete the entry regex101.com that was created by a push operation
diff --git a/test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.out b/test/expected/test_regex101.sh_8e93a3b6b941847c71409a297779fbb0a6666a51.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.err b/test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.err
deleted file mode 100644
index 1a15d40f..00000000
--- a/test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.err
+++ /dev/null
@@ -1,4 +0,0 @@
-✘ error: unable to import: abc
- reason: expecting a format name that matches the regular expression “^\w+$”
- = note:    “def-jkl”
-                ^ matched up to here
diff --git a/test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.out b/test/expected/test_regex101.sh_95c56a9d146ec9a7c2196559d316f928b2ae6ae9.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.err b/test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.err
deleted file mode 100644
index 71baf4f3..00000000
--- a/test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.err
+++ /dev/null
@@ -1 +0,0 @@
-✘ error: no regex101 entry for syslog_log/std
diff --git a/test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.out b/test/expected/test_regex101.sh_9d101ee29c45cdb8c0f117ad736c9a5dd5da5839.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.err b/test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.err
deleted file mode 100644
index 44f87f65..00000000
--- a/test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.err
+++ /dev/null
@@ -1,2 +0,0 @@
-✘ error: unable to get entry “badregex123” on regex101.com
- reason: received response code 400 content “{"error":"Invalid permalink id",}”
diff --git a/test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.out b/test/expected/test_regex101.sh_c43e07df9b3068696fdc8759c7561135db981b38.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.err b/test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.out b/test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.out
deleted file mode 100644
index edb97380..00000000
--- a/test/expected/test_regex101.sh_cbd859487e4ea011cd6e0f0f114d70158bfd8b43.out
+++ /dev/null
@@ -1,37 +0,0 @@
-{
-    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
-    "unit_test_log": {
-        "description": "Format file generated from regex101 entry -- https://regex101.com/r/zpEnjV/2",
-        "regex": {
-            "std": {
-                "pattern": "\\[(?<timestamp>\\d+\\/\\d+\\/\\d+ \\d+:\\d+:\\d+) (?<jobserver>[\\w.]+) (?<workqueue>[\\w.]+) (?<processid>\\d+)\\] (?<body>.*)$"
-            }
-        },
-        "value": {
-            "body": {
-                "kind": "string"
-            },
-            "jobserver": {
-                "kind": "string"
-            },
-            "processid": {
-                "kind": "string"
-            },
-            "timestamp": {
-                "kind": "string"
-            },
-            "workqueue": {
-                "kind": "string"
-            }
-        },
-        "sample": [
-            {
-                "line": "[03/22/2021 02:00:02 job1074.example.com db.db81.example_events 54026] {\"ELAPSED\":\"0.011\",\"LEVEL\":\"info\",\"MESSAGE\":\"finished in 0.011\\n\",\"PREFIX\":\"YFgyWQriCmsAAofJAAAAHg\",\"ROUTINGKEY\":\"EXAMPLE1366.Example.Events._Publish\"}"
-            },
-            {
-                "description": "sample 1",
-                "line": "[03/22/2021 02:00:02 job1074.example.com db.db81.example_events 54026] {\"ELAPSED\":\"0.011\",\"LEVEL\":\"info\",\"MESSAGE\":\"finished in 0.011\\n\",\"PREFIX\":\"YFgyWQriCmsAAofJAAAAHg\",\"ROUTINGKEY\":\"EXAMPLE1366.Example.Events._Publish\"}"
-            }
-        ]
-    }
-}
diff --git a/test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.err b/test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.err
deleted file mode 100644
index 946bbc04..00000000
--- a/test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.err
+++ /dev/null
@@ -1 +0,0 @@
-✘ error: unknown format: non-existent
diff --git a/test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.out b/test/expected/test_regex101.sh_cf6c0a9f0f04e24ce1fae7a0a434830b14447f83.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.err b/test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.err
deleted file mode 100644
index b060ef36..00000000
--- a/test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.err
+++ /dev/null
@@ -1,5 +0,0 @@
-✘ error: expecting an operation to perform on the std regex
- = note: this regex is currently associated with the following regex101.com entry:
-            https://regex101.com/r/zpEnjV
- = help: the available subcommands are:
-          • regex101: use regex101.com to edit this regular expression
diff --git a/test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.out b/test/expected/test_regex101.sh_d84597760285c3964b258726341e018f6cd49954.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.err b/test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.out b/test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.out
deleted file mode 100644
index d37aaa6b..00000000
--- a/test/expected/test_regex101.sh_f23e393dbf23d0d8e276e9b7610c7b74d79980f8.out
+++ /dev/null
@@ -1,15 +0,0 @@
-{
-    "$schema": "https://lnav.org/schemas/format-v1.schema.json",
-    "unit_test_log": {
-        "regex": {
-            "alt": {
-                "pattern": "^\\[(?<timestamp>\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}(?:\\.\\d{3,6})?)Z?\\](?<body>.*)$"
-            }
-        },
-        "sample": [
-            {
-                "line": "[2021-05-21T21:58:57.022497Z]"
-            }
-        ]
-    }
-}
diff --git a/test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.err b/test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.err
deleted file mode 100644
index 12eeea37..00000000
--- a/test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.err
+++ /dev/null
@@ -1 +0,0 @@
-✘ error: “bro” is an internal format that is not defined in a configuration file
diff --git a/test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.out b/test/expected/test_regex101.sh_fc41b6ee90cbf038620151f16d164b361acf82dd.out
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.err b/test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.out b/test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.out
deleted file mode 100644
index 93147a95..00000000
--- a/test/expected/test_shlexer.sh_d5abaa610808635cebb8031a686274d44fcae1b3.out
+++ /dev/null
@@ -1,5 +0,0 @@
-    \a
-esc ^^
-eval -- a
-split:
-  0 -- a
diff --git a/test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.err b/test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.err
deleted file mode 100644
index e69de29b..00000000
diff --git a/test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.out b/test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.out
deleted file mode 100644
index bab237e3..00000000
--- a/test/expected/test_sql_fs_func.sh_549647b59b4fec38734fa58842c0e720c21af120.out
+++ /dev/null
@@ -1,2 +0,0 @@
-Row 0:
-  Column realpath('sql_fs_realpath_test.lnk'): {builddir}/drive_sql
diff --git a/test/test_logfile.sh b/test/test_logfile.sh
index f81b55f4..6e505c10 100644
--- a/test/test_logfile.sh
+++ b/test/test_logfile.sh
@@ -3,6 +3,21 @@
 echo ${top_srcdir}
 echo ${top_builddir}
 
+cat > rollover_in.0 <<EOF
+2600/2 0 00:00:00 0:
+00:2 0 00:00:00 0:
+00:2 0 00:00:00 0:
+EOF
+touch -t 200711030923 rollover_in.0
+
+run_cap_test env TEST_COMMENT="invalid date rollover" ${lnav_test} -n rollover_in.0
+
+printf '#Fields: 0\tcs-bytes\n#Fields: 0\n\t0 #\n0' | run_cap_test \
+    env TEST_COMMENT="w3c with dupe #Fields" ${lnav_test} -n
+
+printf '#Fields: \xf9\t)\n0\n' | run_cap_test \
+    env TEST_COMMENT="garbage w3c fields #1" ${lnav_test} -n
+
 run_cap_test env TEST_COMMENT="w3c with bad header" ${lnav_test} -n <<EOF
 #Fields: 0 time
  00:00