This seems to fix a crash I was seeing.
Trying to reproduce for the logs.
Merge branch 'ossecalert_decoder_crash'
= Added Accumulator Feature to ossec-analysisd.

Accumulator allows the collection of data across multiple log entries by
decoding and grouping on an id field.  The cache for the accumulator
lasts:
    Default expire to 2 minutes (on lookup of exact key)
    Default purge count to 200 lookups (on lookup of any key)
    Default purge interval to 5 minutes (on lookup of any key)

== hash_op.(c|h)
* Change to design of the API, OSHash owns the key's memory, caller owns
  the data elements memory.
* OSHash_Add() strdup's the key
* OSHash_Free() now free()'s the key element
* OSHash_Delete() added so hashes can be dynamic

== accumulator.(c|h)
* This allows log lines to accumulate details based on the previous log
  entries which share the same id element.  Lines must contain, therefor
  the decoder must extract, the id element, or the accumulator simply
  returns without performing any action. It is important to note, this
  is not a multi-line reader, each log line is treated as it's own
  event.  As more data is learned about each ID, the events are able
  to use that data.
* Accumulate_Init() sets up the accumulator constants and initilizations
  variables
* Accumulate() performs the accumulation of event data. The default
  expiry for an event ID is 5 minutes of inactivity.
* Accumulate_CleanUp() is called once every 100 lookups or once every 10
  minutes, whichever happens first.

== etc/decoder.xml
* Enabled accumulator plugin for the OpenLDAP Decoder.  This allows for
  rules to be created with <same_source_ip/>, like with SSHD multiple
  login failures.

Bug fixes included:
 * Accumulator working with in-memory structs
 * Testrule.c now is very flagrant about the accumulator usage
 * Fixed bug in Accumulator_CleanUp() which caused crashes
Git ignore for files which we build
Ignore cJSON.h
more stuff with the travis keys and deploy
adding windows agent to the top level make file
Oops make agent requires root permissions
more clean up for make clean'
Active response was not passing the filename in file events, ie,
syscheck.  The Eventinfo struct only included file data for builds with
Prelude integration.  This prevented the AR from handing filename off
anyways.
* Eventinfo now contains file data always
* Added *expect* option for 'filename'
* Added FILENAME to ar.h
* Filename validation is tricky, so shell escape instead
  * Added os_shell_escape() to string_op.h, allocates memory for an
    escaped string and passes the pointer back to caller. Caller must
    cleanup that memory.
  * Call os_shell_escape() before passing to execd.
* Added string_test.c to test the os_shell_escape() function.
Fixes to exec.c by Micha Nasriachi
apply inode problem fix patch
Convert csyslog JSON output to use the cJSON library.
Linking and libraries sorted out.
Something isn't building, guessing that it's the eventchannel stuff.
Fully remove the event channel stuff.
I guess this is stupid too.
setenv is not avaiable on Win32

This quick fix will add setenv function using the avaiable putenv call.
This should be in a win32 shared section of the code, but I will take
care of that as I clean more of the win32 build process up.
Merging in changes from @cgzones
merging in @cgzones geoip clean