66 lines
2.5 KiB
Diff
66 lines
2.5 KiB
Diff
From b5a060f2ebb8d794f508436a12e4d4163f94b1b8 Mon Sep 17 00:00:00 2001
|
|
From: Laszlo Varady <laszlo.varady@protonmail.com>
|
|
Date: Sat, 20 Aug 2022 12:26:05 +0200
|
|
Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
CVE: CVE-2022-38725
|
|
|
|
Upstream-Status: Backport
|
|
[https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8]
|
|
|
|
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
|
|
|
|
Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
|
|
---
|
|
modules/syslogformat/syslog-format.c | 10 +++++++---
|
|
1 file changed, 7 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
|
|
index aacb525b3..872cc1d71 100644
|
|
--- a/modules/syslogformat/syslog-format.c
|
|
+++ b/modules/syslogformat/syslog-format.c
|
|
@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data,
|
|
const guchar *src = *data;
|
|
gint left = *length;
|
|
|
|
+ if (!left)
|
|
+ return;
|
|
+
|
|
/* Cisco timestamp extensions, the first '*' indicates that the clock is
|
|
* unsynced, '.' if it is known to be synced */
|
|
if (G_UNLIKELY(src[0] == '*'))
|
|
@@ -562,7 +565,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
|
|
open_sd++;
|
|
do
|
|
{
|
|
- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
|
|
+ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
|
|
goto error;
|
|
/* read sd_id */
|
|
pos = 0;
|
|
@@ -595,7 +598,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
|
|
sd_id_len = pos;
|
|
strcpy(sd_value_name, logmsg_sd_prefix);
|
|
strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
|
|
- if (*src == ']')
|
|
+
|
|
+ if (left && *src == ']')
|
|
{
|
|
log_msg_set_value_by_name(self, sd_value_name, "", 0);
|
|
}
|
|
@@ -612,7 +616,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
|
|
else
|
|
goto error;
|
|
|
|
- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
|
|
+ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
|
|
goto error;
|
|
|
|
/* read sd-param */
|
|
--
|
|
2.34.1
|
|
|