bugfix core: potential segfault in template engine

under some circumstances (not entirely clear right now), memory
was freed but later re-used as state-tracking structures were not
properly maintained. Github issue mentioned below has full details.

Thanks to github user snaix for analysing this issue and providing
a patch. I am committing as myself as snaix did not disclose his or
her identity.

closes https://github.com/rsyslog/rsyslog/issues/3019
closes https://github.com/rsyslog/rsyslog/issues/4040
This commit is contained in:
Rainer Gerhards 2018-10-30 10:11:18 +01:00
parent 56b1dd06ae
commit 7852997099
No known key found for this signature in database
GPG Key ID: 0CB6B2A8BE80B499

View File

@ -1162,6 +1162,8 @@ releaseDoActionParams(action_t *__restrict__ const pAction, wti_t *__restrict__
if (ACT_STRING_PASSING == pAction->peParamPassing[j]) {
free(pWrkrInfo->p.nontx.actParams[j].param);
pWrkrInfo->p.nontx.actParams[j].param = NULL;
pWrkrInfo->p.nontx.actParams[j].lenBuf = 0;
pWrkrInfo->p.nontx.actParams[j].lenStr = 0;
}
} else {
switch(pAction->peParamPassing[j]) {
@ -1173,6 +1175,8 @@ releaseDoActionParams(action_t *__restrict__ const pAction, wti_t *__restrict__
json_object_put((struct json_object*)
pWrkrInfo->p.nontx.actParams[j].param);
pWrkrInfo->p.nontx.actParams[j].param = NULL;
pWrkrInfo->p.nontx.actParams[j].lenBuf = 0;
pWrkrInfo->p.nontx.actParams[j].lenStr = 0;
break;
case ACT_STRING_PASSING:
case ACT_MSG_PASSING: