From abb072100e72c07c5cf98b02f5b1a15a48f4b496 Mon Sep 17 00:00:00 2001

From: Yu Watanabe <watanabe.yu+github@gmail.com>

Date: Fri, 4 Jan 2019 15:33:43 +0100

Subject: [PATCH] journal: fix syslog_parse_identifier()

Fixes #9829.

(cherry-picked from commit a6aadf4ae0bae185dc4c414d492a4a781c80ffe5)

Resolves: #1657794

[msekleta: Fix for CVE-2018-16866]

---

 src/journal/journald-syslog.c     | 6 +++---

 src/journal/test-journal-syslog.c | 8 +++++++-

 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/src/journal/journald-syslog.c b/src/journal/journald-syslog.c

index 01d2bf69f4..3ea5d79c3a 100644

--- a/src/journal/journald-syslog.c

+++ b/src/journal/journald-syslog.c

@@ -209,7 +209,7 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)

         e = l;

         l--;

-        if (p[l-1] == ']') {

+        if (l > 0 && p[l-1] == ']') {

                 size_t k = l-1;

                 for (;;) {

@@ -234,8 +234,8 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)

         if (t)

                 *identifier = t;

-        if (strchr(WHITESPACE, p[e]))

-                e++;

+        e += strspn(p + e, WHITESPACE);

+

         *buf = p + e;

         return e;

 }

diff --git a/src/journal/test-journal-syslog.c b/src/journal/test-journal-syslog.c

index c99ca0654b..f56a813774 100644

--- a/src/journal/test-journal-syslog.c

+++ b/src/journal/test-journal-syslog.c

@@ -22,7 +22,7 @@

 #include "journald-syslog.h"

 #include "macro.h"

-static void test_syslog_parse_identifier(const char* str,

+static void test_syslog_parse_identifier(const char *str,

                                          const char *ident, const char*pid, int ret) {

         const char *buf = str;

         _cleanup_free_ char *ident2 = NULL, *pid2 = NULL;

@@ -38,7 +38,13 @@ static void test_syslog_parse_identifier(const char* str,

 int main(void) {

         test_syslog_parse_identifier("pidu[111]: xxx", "pidu", "111", 11);

         test_syslog_parse_identifier("pidu: xxx", "pidu", NULL, 6);

+        test_syslog_parse_identifier("pidu:  xxx", "pidu", NULL, 7);

         test_syslog_parse_identifier("pidu xxx", NULL, NULL, 0);

+        test_syslog_parse_identifier(":", "", NULL, 1);

+        test_syslog_parse_identifier(":  ", "", NULL, 3);

+        test_syslog_parse_identifier("pidu:", "pidu", NULL, 5);

+        test_syslog_parse_identifier("pidu: ", "pidu", NULL, 6);

+        test_syslog_parse_identifier("pidu : ", NULL, NULL, 0);

         return 0;

 }