auparse: fix single-character field trimming

The fix restores the needed vlen guards after the first trim and adds a short reviewer-facing comment explaining why.

Added a regression test that feeds auparse a record containing name=: and acct=, and asserts both fields are parsed as empty strings without crashing.

Author: stevegrubb

auparse/ellist.c

@@ -169,15 +169,16 @@ static int parse_up_record(rnode* r)
 				n.val[vlen-1] = 0;
 				vlen--;
 			}
-			if (n.val[vlen-1] == ',') {
+			// Single-character values can become empty after trimming.
+			if (vlen && n.val[vlen-1] == ',') {
 				n.val[vlen-1] = 0;
 				vlen--;
 			}
-			if (n.val[vlen-1] == '\'') {
+			if (vlen && n.val[vlen-1] == '\'') {
 				n.val[vlen-1] = 0;
 				vlen--;
 			}
-			if (n.val[vlen-1] == ')') {
+			if (vlen && n.val[vlen-1] == ')') {
 				if (strcmp(n.val, "(none)") &&
 					strcmp(n.val, "(null)")) {
 					n.val[vlen-1] = 0;

auparse/test/auparse_extra_test.c

@@ -137,6 +137,22 @@ static void test_path_norm(void)
 	auparse_destroy(au);
 }
 
+
+static void test_single_char_field_values(void)
+{
+	const char buf[] =
+		"type=LOGIN msg=audit(1143146623.787:142): name=: acct=,\n";
+	auparse_state_t *au = auparse_init(AUSOURCE_BUFFER, buf);
+
+	assert(au != NULL);
+	assert(auparse_next_event(au) > 0);
+	assert(auparse_find_field(au, "name") != NULL);
+	assert(strcmp(auparse_get_field_str(au), "") == 0);
+	assert(auparse_find_field(au, "acct") != NULL);
+	assert(strcmp(auparse_get_field_str(au), "") == 0);
+	auparse_destroy(au);
+}
+
 int main(void)
 {
 	test_new_buffer();
@@ -145,6 +161,7 @@ int main(void)
 	test_compare();
 	test_timestamp_milli();
 	test_path_norm();
+	test_single_char_field_values();
 	printf("extra auparse tests: all passed\n");
 	return 0;
 }