|
 |
fde8c1 |
From 5bbd0a4b3c212425ace54bf8a8ede5b832776209 Mon Sep 17 00:00:00 2001
|
|
|
fde8c1 |
From: Rainer Gerhards <rgerhards@adiscon.com>
|
|
|
fde8c1 |
Date: Wed, 6 Sep 2017 13:16:42 +0200
|
|
|
fde8c1 |
Subject: [PATCH] core: memory corruption during configuration parsing
|
|
|
fde8c1 |
|
|
|
fde8c1 |
when omfwd is used with the $streamdriverpermittedpeers legacy
|
|
|
fde8c1 |
parameter, a memory corruption can occur. This depends on the
|
|
|
fde8c1 |
length of the provided strings and probably the malloc subsystem.
|
|
|
fde8c1 |
|
|
|
fde8c1 |
Once config parsing succeeds, no problem can happen.
|
|
|
fde8c1 |
|
|
|
fde8c1 |
Thanks to Brent Douglas for initially reporting this issue and
|
|
|
fde8c1 |
providing great analysis.
|
|
|
fde8c1 |
Thanks to github user bwdoll for analyzing this bug and providing
|
|
|
fde8c1 |
a suggested fix (which is almost what this commit includes).
|
|
|
fde8c1 |
|
|
|
fde8c1 |
closes https://github.com/rsyslog/rsyslog/issues/1408
|
|
|
fde8c1 |
closes https://github.com/rsyslog/rsyslog/issues/1474
|
|
|
fde8c1 |
---
|
|
|
fde8c1 |
tools/omfwd.c | 4 ----
|
|
|
fde8c1 |
1 file changed, 4 deletions(-)
|
|
|
fde8c1 |
|
|
|
fde8c1 |
diff --git a/tools/omfwd.c b/tools/omfwd.c
|
|
|
fde8c1 |
index 3bffbb3cc..8d51fbb51 100644
|
|
|
fde8c1 |
--- a/tools/omfwd.c
|
|
|
fde8c1 |
+++ b/tools/omfwd.c
|
|
|
fde8c1 |
@@ -1157,7 +1157,6 @@ CODESTARTnewActInst
|
|
|
fde8c1 |
pData->pszStrmDrvrAuthMode = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
|
|
|
fde8c1 |
} else if(!strcmp(actpblk.descr[i].name, "streamdriverpermittedpeers")) {
|
|
|
fde8c1 |
uchar *start, *str;
|
|
|
fde8c1 |
- uchar save;
|
|
|
fde8c1 |
uchar *p;
|
|
|
fde8c1 |
int lenStr;
|
|
|
fde8c1 |
str = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
|
|
|
fde8c1 |
@@ -1170,8 +1169,6 @@ CODESTARTnewActInst
|
|
|
fde8c1 |
if(*p == ',') {
|
|
|
fde8c1 |
*p = '\0';
|
|
|
fde8c1 |
}
|
|
|
fde8c1 |
- save = *(p+1); /* we always have this, at least the \0 byte at EOS */
|
|
|
fde8c1 |
- *(p+1) = '\0';
|
|
|
fde8c1 |
if(*start == '\0') {
|
|
|
fde8c1 |
DBGPRINTF("omfwd: ignoring empty permitted peer\n");
|
|
|
fde8c1 |
} else {
|
|
|
fde8c1 |
@@ -1181,7 +1178,6 @@ CODESTARTnewActInst
|
|
|
fde8c1 |
start = p+1;
|
|
|
fde8c1 |
if(lenStr)
|
|
|
fde8c1 |
--lenStr;
|
|
|
fde8c1 |
- *(p+1) = save;
|
|
|
fde8c1 |
}
|
|
|
fde8c1 |
free(str);
|
|
|
fde8c1 |
} else if(!strcmp(actpblk.descr[i].name, "ziplevel")) {
|