Blame SOURCES/rsyslog-8.37.0-rhbz2081396-CVE-2022-24903.patch

9315e5
diff -up rsyslog-8.37.0/plugins/imptcp/imptcp.c.orig rsyslog-8.37.0/plugins/imptcp/imptcp.c
9315e5
--- rsyslog-8.37.0/plugins/imptcp/imptcp.c.orig	2022-05-09 12:22:59.050623119 +0200
9315e5
+++ rsyslog-8.37.0/plugins/imptcp/imptcp.c	2022-05-09 12:34:39.979854853 +0200
9315e5
@@ -1032,7 +1032,10 @@ processDataRcvd(ptcpsess_t *const __rest
9315e5
 			if(pThis->iOctetsRemain <= 200000000) {
9315e5
 				pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
9315e5
 			}
9315e5
-			*(pThis->pMsg + pThis->iMsg++) = c;
9315e5
+			// *(pThis->pMsg + pThis->iMsg++) = c;
9315e5
+			if(pThis->iMsg < iMaxLine) {
9315e5
+				*(pThis->pMsg + pThis->iMsg++) = c;
9315e5
+			}
9315e5
 		} else { /* done with the octet count, so this must be the SP terminator */
9315e5
 			DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain);
9315e5
 			prop.GetString(pThis->peerName, &propPeerName, &lenPeerName);
9315e5
diff -up rsyslog-8.37.0/runtime/tcps_sess.c.orig rsyslog-8.37.0/runtime/tcps_sess.c
9315e5
--- rsyslog-8.37.0/runtime/tcps_sess.c.orig	2022-05-09 12:23:12.789627661 +0200
9315e5
+++ rsyslog-8.37.0/runtime/tcps_sess.c	2022-05-09 12:36:51.426898549 +0200
9315e5
@@ -389,7 +389,10 @@ processDataRcvd(tcps_sess_t *pThis,
9315e5
 			if(pThis->iOctetsRemain <= 200000000) {
9315e5
 				pThis->iOctetsRemain = pThis->iOctetsRemain * 10 + c - '0';
9315e5
 			}
9315e5
-			*(pThis->pMsg + pThis->iMsg++) = c;
9315e5
+			// *(pThis->pMsg + pThis->iMsg++) = c;
9315e5
+			if(pThis->iMsg < iMaxLine) {
9315e5
+				*(pThis->pMsg + pThis->iMsg++) = c;
9315e5
+			}
9315e5
 		} else { /* done with the octet count, so this must be the SP terminator */
9315e5
 			DBGPRINTF("TCP Message with octet-counter, size %d.\n", pThis->iOctetsRemain);
9315e5
 			prop.GetString(pThis->fromHost, &propPeerName, &lenPeerName);