Merge branch 'beta'

Conflicts:

	ChangeLog
	configure.ac
	doc/manual.html
	runtime/rsyslog.h

2 files changed, 25 insertions, 9 deletions

diff --git a/ChangeLog b/ChangeLog
index b7e04890..86520526 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,4 +1,7 @@
 ---------------------------------------------------------------------------
+Version 6.3.5  [DEVEL] (al), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
 Version 6.3.4  [DEVEL] (rgerhards), 2011-08-02
 - added support for action() config object
   * in rsyslog core engine
@@ -43,9 +46,13 @@ Version 6.3.2  [DEVEL] (rgerhards), 2011-07-06
   This leak is tied to error conditions which lead to incorrect cleanup
   of some data structures.
 ---------------------------------------------------------------------------
-Version 6.1.11  [BETA] (rgerhards), 2011-06-??
-- added support for the ":omusrmsg:" syntax in configuring user messages
+Version 6.1.12  [BETA] (al), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
+Version 6.1.11  [BETA] (rgerhards), 2011-07-11
 - systemd support: set stdout/stderr to null - thx to Lennart for the patch
+- added support for the ":omusrmsg:" syntax in configuring user messages
+- added support for the ":omfile:" syntax in configuring user messages
 ---------------------------------------------------------------------------
 Version 6.1.10  [BETA] (rgerhards), 2011-06-22
 - bugfix: problems in failover action handling
@@ -333,6 +340,9 @@ Version 5.9.0  [V5-DEVEL] (rgerhards), 2011-06-08
   affected directive was: $ActionExecOnlyWhenPreviousIsSuspended on
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=236
 ---------------------------------------------------------------------------
+Version 5.8.4  [V5-stable] (al), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
 Version 5.8.3  [V5-stable] (rgerhards), 2011-07-11
 - systemd support: set stdout/stderr to null - thx to Lennart for the patch
 - added support for the ":omusrmsg:" syntax in configuring user messages
@@ -1189,6 +1199,9 @@ Version 4.7.0  [v4-devel] (rgerhards), 2010-04-14
   Thanks for varmojfekoj for pointing me at this bug.
 - imported changes from 4.5.6 and below
 ---------------------------------------------------------------------------
+Version 4.6.8  [v4-stable] (rgerhards), 2011-??-??
+- bugfix: potential misadressing in property replacer
+---------------------------------------------------------------------------
 Version 4.6.7  [v4-stable] (rgerhards), 2011-07-11
 - added support for the ":omusrmsg:" syntax in configuring user messages
 - added support for the ":omfile:" syntax for actions
@@ -1894,6 +1907,7 @@ Version 3.22.4 [v3-stable] (rgerhards), 2010-??-??
   offset
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=271
 - improved some code based on clang static analyzer results
+- bugfix: potential misadressing in property replacer
 ---------------------------------------------------------------------------
 Version 3.22.3 [v3-stable] (rgerhards), 2010-11-24
 - bugfix(important): problem in TLS handling could cause rsyslog to loop
diff --git a/runtime/msg.c b/runtime/msg.c
index 0a79bec2..fdc2174f 100644
--- a/runtime/msg.c
+++ b/runtime/msg.c
@@ -2900,6 +2900,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		}
 	}
 
+dbgprintf("prop repl 4, pRes='%s', len %d\n", pRes, bufLen);
 	/* Take care of spurious characters to make the property safe
 	 * for a path definition
 	 */
@@ -2977,7 +2978,13 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		}
 		
 		/* check for "." and ".." (note the parenthesis in the if condition!) */
-		if((*pRes == '.') && (*(pRes + 1) == '\0' || (*(pRes + 1) == '.' && *(pRes + 2) == '\0'))) {
+		if(*pRes == '\0') {
+			if(*pbMustBeFreed == 1)
+				free(pRes);
+			pRes = UCHAR_CONSTANT("_");
+			bufLen = 1;
+			*pbMustBeFreed = 0;
+		} else if((*pRes == '.') && (*(pRes + 1) == '\0' || (*(pRes + 1) == '.' && *(pRes + 2) == '\0'))) {
 			uchar *pTmp = pRes;
 
 			if(*(pRes + 1) == '\0')
@@ -2987,12 +2994,6 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 			if(*pbMustBeFreed == 1)
 				free(pTmp);
 			*pbMustBeFreed = 0;
-		} else if(*pRes == '\0') {
-			if(*pbMustBeFreed == 1)
-				free(pRes);
-			pRes = UCHAR_CONSTANT("_");
-			bufLen = 1;
-			*pbMustBeFreed = 0;
 		}
 	}
 
@@ -3064,6 +3065,7 @@ uchar *MsgGetProp(msg_t *pMsg, struct templateEntry *pTpe,
 		bufLen = ustrlen(pRes);
 	*pPropLen = bufLen;
 
+dbgprintf("end prop repl, pRes='%s', len %d\n", pRes, bufLen);
 	ENDfunc
 	return(pRes);
 }