Suricata

An error can leave an unclosed json-builder object unclosed:

void EvePacket(const Packet *p, JsonBuilder *js, unsigned long max_length)
{
    unsigned long max_len = max_length == 0 ? GET_PKT_LEN(p) : max_length;
    jb_set_base64(js, "packet", GET_PKT_DATA(p), max_len);

    if (!jb_open_object(js, "packet_info")) {
        return;
    }
    if (!jb_set_uint(js, "linktype", p->datalink)) {
        return;
    }
    jb_close(js);
}

If jb_set_uint were to fail, the object remains unclosed.