1From b5a060f2ebb8d794f508436a12e4d4163f94b1b8 Mon Sep 17 00:00:00 2001
2From: Laszlo Varady <laszlo.varady@protonmail.com>
3Date: Sat, 20 Aug 2022 12:26:05 +0200
4Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer
5MIME-Version: 1.0
6Content-Type: text/plain; charset=UTF-8
7Content-Transfer-Encoding: 8bit
8
9CVE: CVE-2022-38725
10
11Upstream-Status: Backport
12[https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8]
13
14Signed-off-by: László Várady <laszlo.varady@protonmail.com>
15
16Signed-off-by: Yogita Urade <yogita.urade@windriver.com>
17---
18 modules/syslogformat/syslog-format.c | 10 +++++++---
19 1 file changed, 7 insertions(+), 3 deletions(-)
20
21diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
22index aacb525b3..872cc1d71 100644
23--- a/modules/syslogformat/syslog-format.c
24+++ b/modules/syslogformat/syslog-format.c
25@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data,
26   const guchar *src = *data;
27   gint left = *length;
28
29+  if (!left)
30+    return;
31+
32   /* Cisco timestamp extensions, the first '*' indicates that the clock is
33    * unsynced, '.' if it is known to be synced */
34   if (G_UNLIKELY(src[0] == '*'))
35@@ -562,7 +565,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
36       open_sd++;
37       do
38         {
39-          if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
40+          if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
41             goto error;
42           /* read sd_id */
43           pos = 0;
44@@ -595,7 +598,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
45           sd_id_len = pos;
46           strcpy(sd_value_name, logmsg_sd_prefix);
47           strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
48-          if (*src == ']')
49+
50+          if (left && *src == ']')
51             {
52               log_msg_set_value_by_name(self, sd_value_name, "", 0);
53             }
54@@ -612,7 +616,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
55               else
56                 goto error;
57
58-              if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
59+              if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
60                 goto error;
61
62               /* read sd-param */
63--
642.34.1
65
66