bugfix: imuxsock did truncate part of received message if it did not contain a proper date.

The truncation occured because we removed that part of the messages
that was expected to be the date.
closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295

2 files changed, 9 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index 26d6762a..3f5031ea 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,9 @@
 ---------------------------------------------------------------------------
 Version 5.8.7  [V5-stable] 2011-??-??
+- bugfix: imuxsock did truncate part of received message if it did not
+  contain a proper date. The truncation occured because we removed that
+  part of the messages that was expected to be the date.
+  closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295
 - bugfix: potential abort after reading invalid X.509 certificate
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290
   Thanks to Tomas Heinrich for the patch
diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c
index 2697c48a..feddb20c 100644
--- a/plugins/imuxsock/imuxsock.c
+++ b/plugins/imuxsock/imuxsock.c
@@ -565,8 +565,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred)
 	parse++; lenMsg--; /* '>' */
 
 	if((pLstn->flags & IGNDATE)) {
-		parse += 16; /* just skip timestamp */
-		lenMsg -= 16;
+		/* in this case, we still need to find out if we have a valid
+		 * datestamp or not .. and advance the parse pointer accordingly.
+		 */
+		struct syslogTime dummy;
+		datetime.ParseTIMESTAMP3164(&dummy, &parse, &lenMsg);
 	} else {
 		if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &parse, &lenMsg) != RS_RET_OK) {
 			DBGPRINTF("we have a problem, invalid timestamp in msg!\n");