From b5a060f2ebb8d794f508436a12e4d4163f94b1b8 Mon Sep 17 00:00:00 2001 From: Laszlo Varady Date: Sat, 20 Aug 2022 12:26:05 +0200 Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE: CVE-2022-38725 Upstream-Status: Backport [https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8] Signed-off-by: László Várady Signed-off-by: Yogita Urade --- modules/syslogformat/syslog-format.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c index aacb525b3..872cc1d71 100644 --- a/modules/syslogformat/syslog-format.c +++ b/modules/syslogformat/syslog-format.c @@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data, const guchar *src = *data; gint left = *length; + if (!left) + return; + /* Cisco timestamp extensions, the first '*' indicates that the clock is * unsynced, '.' if it is known to be synced */ if (G_UNLIKELY(src[0] == '*')) @@ -562,7 +565,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF open_sd++; do { - if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') + if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') goto error; /* read sd_id */ pos = 0; @@ -595,7 +598,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF sd_id_len = pos; strcpy(sd_value_name, logmsg_sd_prefix); strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len); - if (*src == ']') + + if (left && *src == ']') { log_msg_set_value_by_name(self, sd_value_name, "", 0); } @@ -612,7 +616,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF else goto error; - if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') + if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') goto error; /* read sd-param */ -- 2.34.1