1*4882a593SmuzhiyunFrom 73b5c300b8fde5e7a4824baa83a04931279abb37 Mon Sep 17 00:00:00 2001 2*4882a593SmuzhiyunFrom: Laszlo Varady <laszlo.varady@protonmail.com> 3*4882a593SmuzhiyunDate: Sat, 20 Aug 2022 12:42:38 +0200 4*4882a593SmuzhiyunSubject: [PATCH 4/8] timeutils: fix iterating out of the range of timestamp buffer 5*4882a593SmuzhiyunMIME-Version: 1.0 6*4882a593SmuzhiyunContent-Type: text/plain; charset=UTF-8 7*4882a593SmuzhiyunContent-Transfer-Encoding: 8bit 8*4882a593Smuzhiyun 9*4882a593SmuzhiyunCVE: CVE-2022-38725 10*4882a593Smuzhiyun 11*4882a593SmuzhiyunUpstream-Status: Backport 12*4882a593Smuzhiyun[https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37] 13*4882a593Smuzhiyun 14*4882a593SmuzhiyunSigned-off-by: László Várady <laszlo.varady@protonmail.com> 15*4882a593SmuzhiyunSigned-off-by: Balazs Scheidler <bazsi77@gmail.com> 16*4882a593Smuzhiyun 17*4882a593SmuzhiyunSigned-off-by: Yogita Urade <yogita.urade@windriver.com> 18*4882a593Smuzhiyun--- 19*4882a593Smuzhiyun lib/timeutils/scan-timestamp.c | 2 +- 20*4882a593Smuzhiyun 1 file changed, 1 insertion(+), 1 deletion(-) 21*4882a593Smuzhiyun 22*4882a593Smuzhiyundiff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c 23*4882a593Smuzhiyunindex 304a57673..4fbe94a36 100644 24*4882a593Smuzhiyun--- a/lib/timeutils/scan-timestamp.c 25*4882a593Smuzhiyun+++ b/lib/timeutils/scan-timestamp.c 26*4882a593Smuzhiyun@@ -332,7 +332,7 @@ __parse_usec(const guchar **data, gint *length) 27*4882a593Smuzhiyun src++; 28*4882a593Smuzhiyun (*length)--; 29*4882a593Smuzhiyun } 30*4882a593Smuzhiyun- while (isdigit(*src)) 31*4882a593Smuzhiyun+ while (*length > 0 && isdigit(*src)) 32*4882a593Smuzhiyun { 33*4882a593Smuzhiyun src++; 34*4882a593Smuzhiyun (*length)--; 35*4882a593Smuzhiyun-- 36*4882a593Smuzhiyun2.34.1 37*4882a593Smuzhiyun 38