1*4882a593SmuzhiyunFrom 4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Laszlo Varady <laszlo.varady@protonmail.com> 3*4882a593SmuzhiyunDate: Sun, 21 Aug 2022 18:44:28 +0200 4*4882a593SmuzhiyunSubject: [PATCH 3/8] syslogformat: fix reading cisco sequence id out of bounds 5*4882a593SmuzhiyunMIME-Version: 1.0 6*4882a593SmuzhiyunContent-Type: text/plain; charset=UTF-8 7*4882a593SmuzhiyunContent-Transfer-Encoding: 8bit 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunCVE: CVE-2022-38725 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunUpstream-Status: Backport 12*4882a593Smuzhiyun[https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d] 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunSigned-off-by: László Várady <laszlo.varady@protonmail.com> 15*4882a593Smuzhiyun 16*4882a593SmuzhiyunSigned-off-by: Yogita Urade <yogita.urade@windriver.com> 17*4882a593Smuzhiyun--- 18*4882a593Smuzhiyun modules/syslogformat/syslog-format.c | 2 +- 19*4882a593Smuzhiyun .../syslogformat/tests/test_syslog_format.c | 32 +++++++++++++++++++ 20*4882a593Smuzhiyun 2 files changed, 33 insertions(+), 1 deletion(-) 21*4882a593Smuzhiyun 22*4882a593Smuzhiyundiff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c 23*4882a593Smuzhiyunindex 872cc1d71..a3d48d6f2 100644 24*4882a593Smuzhiyun--- a/modules/syslogformat/syslog-format.c 25*4882a593Smuzhiyun+++ b/modules/syslogformat/syslog-format.c 26*4882a593Smuzhiyun@@ -207,7 +207,7 @@ log_msg_parse_cisco_sequence_id(LogMessage *self, const guchar **data, gint *len 27*4882a593Smuzhiyun 28*4882a593Smuzhiyun /* if the next char is not space, then we may try to read a date */ 29*4882a593Smuzhiyun 30*4882a593Smuzhiyun- if (*src != ' ') 31*4882a593Smuzhiyun+ if (!left || *src != ' ') 32*4882a593Smuzhiyun return; 33*4882a593Smuzhiyun 34*4882a593Smuzhiyun log_msg_set_value(self, handles.cisco_seqid, (gchar *) *data, *length - left - 1); 35*4882a593Smuzhiyundiff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c 36*4882a593Smuzhiyunindex b247fe3c5..d0f5b4043 100644 37*4882a593Smuzhiyun--- a/modules/syslogformat/tests/test_syslog_format.c 38*4882a593Smuzhiyun+++ b/modules/syslogformat/tests/test_syslog_format.c 39*4882a593Smuzhiyun@@ -70,3 +70,35 @@ Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeou 40*4882a593Smuzhiyun msg_format_options_destroy(&parse_options); 41*4882a593Smuzhiyun log_msg_unref(msg); 42*4882a593Smuzhiyun } 43*4882a593Smuzhiyun+ 44*4882a593Smuzhiyun+Test(syslog_format, cisco_sequence_id_non_zero_termination) 45*4882a593Smuzhiyun+{ 46*4882a593Smuzhiyun+ const gchar *data = "<189>65536: "; 47*4882a593Smuzhiyun+ gsize data_length = strlen(data); 48*4882a593Smuzhiyun+ 49*4882a593Smuzhiyun+ msg_format_options_init(&parse_options, cfg); 50*4882a593Smuzhiyun+ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length); 51*4882a593Smuzhiyun+ 52*4882a593Smuzhiyun+ gsize problem_position; 53*4882a593Smuzhiyun+ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position)); 54*4882a593Smuzhiyun+ cr_assert_str_eq(log_msg_get_value_by_name(msg, ".SDATA.meta.sequenceId", NULL), "65536"); 55*4882a593Smuzhiyun+ 56*4882a593Smuzhiyun+ msg_format_options_destroy(&parse_options); 57*4882a593Smuzhiyun+ log_msg_unref(msg); 58*4882a593Smuzhiyun+} 59*4882a593Smuzhiyun+ 60*4882a593Smuzhiyun+Test(syslog_format, minimal_non_zero_terminated_numeric_message_is_parsed_as_program_name) 61*4882a593Smuzhiyun+{ 62*4882a593Smuzhiyun+ const gchar *data = "<189>65536"; 63*4882a593Smuzhiyun+ gsize data_length = strlen(data); 64*4882a593Smuzhiyun+ 65*4882a593Smuzhiyun+ msg_format_options_init(&parse_options, cfg); 66*4882a593Smuzhiyun+ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length); 67*4882a593Smuzhiyun+ 68*4882a593Smuzhiyun+ gsize problem_position; 69*4882a593Smuzhiyun+ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position)); 70*4882a593Smuzhiyun+ cr_assert_str_eq(log_msg_get_value_by_name(msg, "PROGRAM", NULL), "65536"); 71*4882a593Smuzhiyun+ 72*4882a593Smuzhiyun+ msg_format_options_destroy(&parse_options); 73*4882a593Smuzhiyun+ log_msg_unref(msg); 74*4882a593Smuzhiyun+} 75*4882a593Smuzhiyun-- 76*4882a593Smuzhiyun2.34.1 77*4882a593Smuzhiyun 78