rsyslog/rsyslog
1
0
Fork 0
mirror of https://github.com/rsyslog/rsyslog.git synced 2025-12-16 09:50:40 +01:00
Code Issues Packages Projects Releases Wiki Activity

core: memory corruption during configuration parsing

Browse Source 
when omfwd is used with the $streamdriverpermittedpeers legacy
parameter, a memory corruption can occur. This depends on the
length of the provided strings and probably the malloc subsystem.

Once config parsing succeeds, no problem can happen.

Thanks to Brent Douglas for initially reporting this issue and
providing great analysis.
Thanks to github user bwdoll for analyzing this bug and providing
a suggested fix (which is almost what this commit includes).

closes https://github.com/rsyslog/rsyslog/issues/1408
closes https://github.com/rsyslog/rsyslog/issues/1474
This commit is contained in:
Rainer Gerhards 2017-09-06 13:16:42 +02:00
parent 26c3520ba2
commit 5bbd0a4b3c
1 changed files with 0 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
tools/omfwd.c
View File

@ -1157,7 +1157,6 @@ CODESTARTnewActInst
pData->pszStrmDrvrAuthMode = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
} else if(!strcmp(actpblk.descr[i].name, "streamdriverpermittedpeers")) {
uchar *start, *str;
uchar save;
uchar *p;
int lenStr;
str = (uchar*)es_str2cstr(pvals[i].val.d.estr, NULL);
@ -1170,8 +1169,6 @@ CODESTARTnewActInst
if(*p == ',') {
*p = '\0';
}
save = *(p+1); /* we always have this, at least the \0 byte at EOS */
*(p+1) = '\0';
if(*start == '\0') {
DBGPRINTF("omfwd: ignoring empty permitted peer\n");
} else {
@ -1181,7 +1178,6 @@ CODESTARTnewActInst
start = p+1;
if(lenStr)
--lenStr;
*(p+1) = save;
}
free(str);
} else if(!strcmp(actpblk.descr[i].name, "ziplevel")) {