Merge branch 'v5-stable' into beta

Conflicts:

	ChangeLog

3 files changed, 20 insertions, 8 deletions

diff --git a/ChangeLog b/ChangeLog
index 492120d0..09dfc72e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,7 @@
 ---------------------------------------------------------------------------
+Version 6.1.12  [BETA] (al), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
 Version 6.1.11  [BETA] (rgerhards), 2011-07-11
 - systemd support: set stdout/stderr to null - thx to Lennart for the patch
 - added support for the ":omusrmsg:" syntax in configuring user messages
@@ -211,6 +214,9 @@ Version 5.9.0  [V5-DEVEL] (rgerhards), 2011-03-??
   affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=236
 ---------------------------------------------------------------------------
+Version 5.8.4  [V5-stable] (al), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
 Version 5.8.3  [V5-stable] (rgerhards), 2011-07-11
 - systemd support: set stdout/stderr to null - thx to Lennart for the patch
 - added support for the ":omusrmsg:" syntax in configuring user messages
@@ -1065,6 +1071,9 @@ Version 4.7.0  [v4-devel] (rgerhards), 2010-04-14
   Thanks for varmojfekoj for pointing me at this bug.
 - imported changes from 4.5.6 and below
 ---------------------------------------------------------------------------
+Version 4.6.8  [v4-stable] (rgerhards), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
 Version 4.6.7  [v4-stable] (rgerhards), 2011-07-11
 - added support for the ":omusrmsg:" syntax in configuring user messages
 - added support for the ":omfile:" syntax in configuring user messages
@@ -1770,6 +1779,7 @@ Version 3.22.4 [v3-stable] (rgerhards), 2010-??-??
   offset
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
 - improved some code based on clang static analyzer results
+- bugfix: potential misadressing in property replacer
 ---------------------------------------------------------------------------
 Version 3.22.3 [v3-stable] (rgerhards), 2010-11-24
 - bugfix(important): problem in TLS handling could cause rsyslog to loop
diff --git a/plugins/pmaixforwardedfrom/pmaixforwardedfrom.c b/plugins/pmaixforwardedfrom/pmaixforwardedfrom.c
index fa4a9087..fe3e85fa 100644
--- a/plugins/pmaixforwardedfrom/pmaixforwardedfrom.c
+++ b/plugins/pmaixforwardedfrom/pmaixforwardedfrom.c
@@ -1,6 +1,6 @@
 /* pmaixforwardedfrom.c
  *
- * this detects logs sent by Cisco devices that mangle their syslog output when you tell them to log by name by adding ' :' between the name and the %XXX-X-XXXXXXX: tag
+ * this cleans up messages forwarded from AIX
  * 
  * instead of actually parsing the message, this modifies the message and then falls through to allow a later parser to handle the now modified message
  *
diff --git a/runtime/msg.c b/runtime/msg.c
index c5cbb5c8..f1701909 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -2926,6 +2926,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		}
 	}
 
+dbgprintf("prop repl 4, pRes='%s', len %d\n", pRes, bufLen);
 	/* Take care of spurious characters to make the property safe
 	 * for a path definition
 	 */
@@ -3003,7 +3004,13 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		}
 		
 		/* check for "." and ".." (note the parenthesis in the if condition!) */
-		if((*pRes == '.') && (*(pRes + 1) == '\0' || (*(pRes + 1) == '.' && *(pRes + 2) == '\0'))) {
+		if(*pRes == '\0') {
+			if(*pbMustBeFreed == 1)
+				free(pRes);
+			pRes = UCHAR_CONSTANT("_");
+			bufLen = 1;
+			*pbMustBeFreed = 0;
+		} else if((*pRes == '.') && (*(pRes + 1) == '\0' || (*(pRes + 1) == '.' && *(pRes + 2) == '\0'))) {
 			uchar *pTmp = pRes;
 
 			if(*(pRes + 1) == '\0')
@@ -3013,12 +3020,6 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 			if(*pbMustBeFreed == 1)
 				free(pTmp);
 			*pbMustBeFreed = 0;
-		} else if(*pRes == '\0') {
-			if(*pbMustBeFreed == 1)
-				free(pRes);
-			pRes = UCHAR_CONSTANT("_");
-			bufLen = 1;
-			*pbMustBeFreed = 0;
 		}
 	}
 
@@ -3090,6 +3091,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		bufLen = ustrlen(pRes);
 	*pPropLen = bufLen;
 
+dbgprintf("end prop repl, pRes='%s', len %d\n", pRes, bufLen);
 	ENDfunc
 	return(pRes);
 }