|
 |
c17bfd |
From cc3098b63174b8aa875d1f2e9c6ea94407b211b8 Mon Sep 17 00:00:00 2001
|
|
|
c17bfd |
From: Rainer Gerhards <rgerhards@adiscon.com>
|
|
|
c17bfd |
Date: Thu, 16 Feb 2017 19:02:36 +0100
|
|
|
c17bfd |
Subject: [PATCH 04/11] Bug 1582517 - rsyslog: Buffer overflow in memcpy() in parser.c
|
|
|
c17bfd |
|
|
|
c17bfd |
core: fix potential misadressing in parser message sanitizer
|
|
|
c17bfd |
|
|
|
c17bfd |
misadressing could happen when an oversize message made it to the
|
|
|
c17bfd |
sanitizer AND contained a control character in the oversize part
|
|
|
c17bfd |
of the message. Note that it is an error in itself that such an
|
|
|
c17bfd |
oversize message enters the system, but we harden the sanitizer
|
|
|
c17bfd |
to handle this gracefully (it will truncate the message).
|
|
|
c17bfd |
|
|
|
c17bfd |
Note that truncation may still - as previously - happen if the
|
|
|
c17bfd |
number of escape characters makes the string grow above the max
|
|
|
c17bfd |
message size.
|
|
|
c17bfd |
|
|
|
c17bfd |
(cherry picked from commit 20f8237870eb5e971fa068e4dd4d296f1dbef329)
|
|
|
c17bfd |
---
|
|
|
c17bfd |
runtime/parser.c | 8 +++++++-
|
|
|
c17bfd |
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
|
c17bfd |
|
|
|
c17bfd |
diff --git a/runtime/parser.c b/runtime/parser.c
|
|
|
c17bfd |
index 0574d982a..9645baa40 100644
|
|
|
c17bfd |
--- a/runtime/parser.c
|
|
|
c17bfd |
+++ b/runtime/parser.c
|
|
|
c17bfd |
@@ -464,9 +464,15 @@ SanitizeMsg(smsg_t *pMsg)
|
|
|
c17bfd |
if(maxDest < sizeof(szSanBuf))
|
|
|
c17bfd |
pDst = szSanBuf;
|
|
|
c17bfd |
else
|
|
|
c17bfd |
- CHKmalloc(pDst = MALLOC(iMaxLine + 1));
|
|
|
c17bfd |
+ CHKmalloc(pDst = MALLOC(maxDest + 1));
|
|
|
c17bfd |
if(iSrc > 0) {
|
|
|
c17bfd |
iSrc--; /* go back to where everything is OK */
|
|
|
c17bfd |
+ if(iSrc > maxDest) {
|
|
|
c17bfd |
+ DBGPRINTF("parser.Sanitize: have oversize index %zd, "
|
|
|
c17bfd |
+ "max %zd - corrected, but should not happen\n",
|
|
|
c17bfd |
+ iSrc, maxDest);
|
|
|
c17bfd |
+ iSrc = maxDest;
|
|
|
c17bfd |
+ }
|
|
|
c17bfd |
memcpy(pDst, pszMsg, iSrc); /* fast copy known good */
|
|
|
c17bfd |
}
|
|
|
c17bfd |
iDst = iSrc;
|
|
|
c17bfd |
--
|
|
|
c17bfd |
2.14.4
|
|
|
c17bfd |
|