|
 |
763e28 |
From 1255a67fdec2fc44cd49b6ea8c463f4319910812 Mon Sep 17 00:00:00 2001
|
|
|
763e28 |
From: Jiri Vymazal <jvymazal@redhat.com>
|
|
|
763e28 |
Date: Wed, 27 Feb 2019 11:57:49 +0100
|
|
|
763e28 |
Subject: [PATCH] Enlarged msg offset types for bigger structured messages
|
|
|
763e28 |
|
|
|
763e28 |
using a large enough (dozens of kBs) structured message
|
|
|
763e28 |
it is possible to overflow the signed short type which leads
|
|
|
763e28 |
to rsyslog crash.
|
|
|
763e28 |
---
|
|
|
763e28 |
runtime/msg.c | 12 ++++++------
|
|
|
763e28 |
runtime/msg.h | 8 ++++----
|
|
|
763e28 |
2 files changed, 10 insertions(+), 10 deletions(-)
|
|
|
763e28 |
|
|
|
763e28 |
diff --git a/runtime/msg.c b/runtime/msg.c
|
|
|
763e28 |
index b82c38b9ee..96306bbeab 100644
|
|
|
763e28 |
--- a/runtime/msg.c
|
|
|
763e28 |
+++ b/runtime/msg.c
|
|
|
763e28 |
@@ -839,7 +839,7 @@ msgBaseConstruct(smsg_t **ppThis)
|
|
|
763e28 |
pM->iFacility = LOG_INVLD;
|
|
|
763e28 |
pM->iLenPROGNAME = -1;
|
|
|
763e28 |
pM->offAfterPRI = 0;
|
|
|
763e28 |
- pM->offMSG = -1;
|
|
|
763e28 |
+ pM->offMSG = 0;
|
|
|
763e28 |
pM->iProtocolVersion = 0;
|
|
|
763e28 |
pM->msgFlags = 0;
|
|
|
763e28 |
pM->iLenRawMsg = 0;
|
|
|
763e28 |
@@ -2167,7 +2167,7 @@ MsgSetFlowControlType(smsg_t * const pMsg, flowControl_t eFlowCtl)
|
|
|
763e28 |
* rgerhards, 2009-06-16
|
|
|
763e28 |
*/
|
|
|
763e28 |
rsRetVal
|
|
|
763e28 |
-MsgSetAfterPRIOffs(smsg_t * const pMsg, short offs)
|
|
|
763e28 |
+MsgSetAfterPRIOffs(smsg_t * const pMsg, uint32_t offs)
|
|
|
763e28 |
{
|
|
|
763e28 |
assert(pMsg != NULL);
|
|
|
763e28 |
pMsg->offAfterPRI = offs;
|
|
|
763e28 |
@@ -2819,12 +2819,12 @@ void MsgSetHOSTNAME(smsg_t *pThis, const uchar* pszHOSTNAME, const int lenHOSTNA
|
|
|
763e28 |
* (exactly by one). This can happen if we have a message that does not
|
|
|
763e28 |
* contain any MSG part.
|
|
|
763e28 |
*/
|
|
|
763e28 |
-void MsgSetMSGoffs(smsg_t * const pMsg, short offs)
|
|
|
763e28 |
+void MsgSetMSGoffs(smsg_t * const pMsg, uint32_t offs)
|
|
|
763e28 |
{
|
|
|
763e28 |
ISOBJ_TYPE_assert(pMsg, msg);
|
|
|
763e28 |
pMsg->offMSG = offs;
|
|
|
763e28 |
- if(offs > pMsg->iLenRawMsg) {
|
|
|
763e28 |
- assert(offs - 1 == pMsg->iLenRawMsg);
|
|
|
763e28 |
+ if(offs > (uint32_t)pMsg->iLenRawMsg) {
|
|
|
763e28 |
+ assert((int)offs - 1 == pMsg->iLenRawMsg);
|
|
|
763e28 |
pMsg->iLenMSG = 0;
|
|
|
763e28 |
} else {
|
|
|
763e28 |
pMsg->iLenMSG = pMsg->iLenRawMsg - offs;
|
|
|
763e28 |
@@ -2920,7 +2920,7 @@ MsgSetRawMsg(smsg_t *const pThis, const char*const pszRawMsg, const size_t lenMs
|
|
|
763e28 |
memcpy(pThis->pszRawMsg, pszRawMsg, pThis->iLenRawMsg);
|
|
|
763e28 |
pThis->pszRawMsg[pThis->iLenRawMsg] = '\0'; /* this also works with truncation! */
|
|
|
763e28 |
/* correct other information */
|
|
|
763e28 |
- if(pThis->iLenRawMsg > pThis->offMSG)
|
|
|
763e28 |
+ if((uint32_t)pThis->iLenRawMsg > pThis->offMSG)
|
|
|
763e28 |
pThis->iLenMSG += deltaSize;
|
|
|
763e28 |
else
|
|
|
763e28 |
pThis->iLenMSG = 0;
|
|
|
763e28 |
diff --git a/runtime/msg.h b/runtime/msg.h
|
|
|
763e28 |
index 74439275b1..722cca6e8a 100644
|
|
|
763e28 |
--- a/runtime/msg.h
|
|
|
763e28 |
+++ b/runtime/msg.h
|
|
|
763e28 |
@@ -67,8 +67,8 @@ struct msg {
|
|
|
763e28 |
sbool bParseSuccess; /* set to reflect state of last executed higher level parser */
|
|
|
763e28 |
unsigned short iSeverity;/* the severity */
|
|
|
763e28 |
unsigned short iFacility;/* Facility code */
|
|
|
763e28 |
- short offAfterPRI; /* offset, at which raw message WITHOUT PRI part starts in pszRawMsg */
|
|
|
763e28 |
- short offMSG; /* offset at which the MSG part starts in pszRawMsg */
|
|
|
763e28 |
+ uint32_t offAfterPRI; /* offset, at which raw message WITHOUT PRI part starts in pszRawMsg */
|
|
|
763e28 |
+ uint32_t offMSG; /* offset at which the MSG part starts in pszRawMsg */
|
|
|
763e28 |
short iProtocolVersion;/* protocol version of message received 0 - legacy, 1 syslog-protocol) */
|
|
|
763e28 |
int msgFlags; /* flags associated with this message */
|
|
|
763e28 |
int iLenRawMsg; /* length of raw message */
|
|
|
763e28 |
@@ -194,8 +194,8 @@ void MsgSetRcvFromStr(smsg_t *const pMsg, const uchar* pszRcvFrom, const int, pr
|
|
|
763e28 |
rsRetVal MsgSetRcvFromIP(smsg_t *pMsg, prop_t*);
|
|
|
763e28 |
rsRetVal MsgSetRcvFromIPStr(smsg_t *const pThis, const uchar *psz, const int len, prop_t **ppProp);
|
|
|
763e28 |
void MsgSetHOSTNAME(smsg_t *pMsg, const uchar* pszHOSTNAME, const int lenHOSTNAME);
|
|
|
763e28 |
-rsRetVal MsgSetAfterPRIOffs(smsg_t *pMsg, short offs);
|
|
|
763e28 |
-void MsgSetMSGoffs(smsg_t *pMsg, short offs);
|
|
|
763e28 |
+rsRetVal MsgSetAfterPRIOffs(smsg_t *pMsg, uint32_t offs);
|
|
|
763e28 |
+void MsgSetMSGoffs(smsg_t *pMsg, uint32_t offs);
|
|
|
763e28 |
void MsgSetRawMsgWOSize(smsg_t *pMsg, char* pszRawMsg);
|
|
|
763e28 |
void ATTR_NONNULL() MsgSetRawMsg(smsg_t *const pThis, const char*const pszRawMsg, const size_t lenMsg);
|
|
|
763e28 |
rsRetVal MsgReplaceMSG(smsg_t *pThis, const uchar* pszMSG, int lenMSG);
|