1*4882a593SmuzhiyunFrom b5a060f2ebb8d794f508436a12e4d4163f94b1b8 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Laszlo Varady <laszlo.varady@protonmail.com> 3*4882a593SmuzhiyunDate: Sat, 20 Aug 2022 12:26:05 +0200 4*4882a593SmuzhiyunSubject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer 5*4882a593SmuzhiyunMIME-Version: 1.0 6*4882a593SmuzhiyunContent-Type: text/plain; charset=UTF-8 7*4882a593SmuzhiyunContent-Transfer-Encoding: 8bit 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunCVE: CVE-2022-38725 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunUpstream-Status: Backport 12*4882a593Smuzhiyun[https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8] 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunSigned-off-by: László Várady <laszlo.varady@protonmail.com> 15*4882a593Smuzhiyun 16*4882a593SmuzhiyunSigned-off-by: Yogita Urade <yogita.urade@windriver.com> 17*4882a593Smuzhiyun--- 18*4882a593Smuzhiyun modules/syslogformat/syslog-format.c | 10 +++++++--- 19*4882a593Smuzhiyun 1 file changed, 7 insertions(+), 3 deletions(-) 20*4882a593Smuzhiyun 21*4882a593Smuzhiyundiff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c 22*4882a593Smuzhiyunindex aacb525b3..872cc1d71 100644 23*4882a593Smuzhiyun--- a/modules/syslogformat/syslog-format.c 24*4882a593Smuzhiyun+++ b/modules/syslogformat/syslog-format.c 25*4882a593Smuzhiyun@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data, 26*4882a593Smuzhiyun const guchar *src = *data; 27*4882a593Smuzhiyun gint left = *length; 28*4882a593Smuzhiyun 29*4882a593Smuzhiyun+ if (!left) 30*4882a593Smuzhiyun+ return; 31*4882a593Smuzhiyun+ 32*4882a593Smuzhiyun /* Cisco timestamp extensions, the first '*' indicates that the clock is 33*4882a593Smuzhiyun * unsynced, '.' if it is known to be synced */ 34*4882a593Smuzhiyun if (G_UNLIKELY(src[0] == '*')) 35*4882a593Smuzhiyun@@ -562,7 +565,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF 36*4882a593Smuzhiyun open_sd++; 37*4882a593Smuzhiyun do 38*4882a593Smuzhiyun { 39*4882a593Smuzhiyun- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') 40*4882a593Smuzhiyun+ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') 41*4882a593Smuzhiyun goto error; 42*4882a593Smuzhiyun /* read sd_id */ 43*4882a593Smuzhiyun pos = 0; 44*4882a593Smuzhiyun@@ -595,7 +598,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF 45*4882a593Smuzhiyun sd_id_len = pos; 46*4882a593Smuzhiyun strcpy(sd_value_name, logmsg_sd_prefix); 47*4882a593Smuzhiyun strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len); 48*4882a593Smuzhiyun- if (*src == ']') 49*4882a593Smuzhiyun+ 50*4882a593Smuzhiyun+ if (left && *src == ']') 51*4882a593Smuzhiyun { 52*4882a593Smuzhiyun log_msg_set_value_by_name(self, sd_value_name, "", 0); 53*4882a593Smuzhiyun } 54*4882a593Smuzhiyun@@ -612,7 +616,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF 55*4882a593Smuzhiyun else 56*4882a593Smuzhiyun goto error; 57*4882a593Smuzhiyun 58*4882a593Smuzhiyun- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') 59*4882a593Smuzhiyun+ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"') 60*4882a593Smuzhiyun goto error; 61*4882a593Smuzhiyun 62*4882a593Smuzhiyun /* read sd-param */ 63*4882a593Smuzhiyun-- 64*4882a593Smuzhiyun2.34.1 65*4882a593Smuzhiyun 66