From 4d01df57c2f378ceda3bcc400a9df5e50a0c007b Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Wed, 1 Aug 2012 10:14:37 +0200
Subject: bugfix: potential abort if output plugin logged message during
 shutdown

note that none of the rsyslog-provided plugins does this
Thanks to bodik and Rohit Prasad for alerting us on this bug and
analyzing it.
fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=347
---
 ChangeLog       | 13 +++++++++----
 tools/syslogd.c | 22 +++++++++++++++++++---
 2 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index a081893b..eb8230dc 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,10 +8,15 @@ Version 5.8.13  [V5-stable] 2012-06-??
 - bugfix: randomized IP option header in omudpspoof caused problems
   closes: http://bugzilla.adiscon.com/show_bug.cgi?id=327
   Thanks to Rick Brown for helping to test out the patch.
-- bugfix: DA queue fixed handling of bad queue files. If old queue files 
-  existed, they were not truncated when being reused. this could lead to 
-  extra data being read from them and in consequence data format errors, 
-  which could cause trouble to the queue handler. 
+- bugfix: DA queue fixed handling of bad queue files
+  If old queue files existed, they were not truncated when being reused.
+  This could lead to extra data being read from them and in consequence
+  data format errors, which could cause trouble to the queue handler. 
+- bugfix: potential abort if output plugin logged message during shutdown
+  note that none of the rsyslog-provided plugins does this
+  Thanks to bodik and Rohit Prasad for alerting us on this bug and
+  analyzing it.
+  fixes: http://bugzilla.adiscon.com/show_bug.cgi?id=347
 ---------------------------------------------------------------------------
 Version 5.8.12  [V5-stable] 2012-06-06
 - add small delay (50ms) after sending shutdown message
diff --git a/tools/syslogd.c b/tools/syslogd.c
index cbbb66bc..8fc1d1e1 100644
--- a/tools/syslogd.c
+++ b/tools/syslogd.c
@@ -725,11 +725,19 @@ submitMsg(msg_t *pMsg)
 	ISOBJ_TYPE_assert(pMsg, msg);
 
 	pRuleset = MsgGetRuleset(pMsg);
-
 	pQueue = (pRuleset == NULL) ? pMsgQueue : ruleset.GetRulesetQueue(pRuleset);
+
+	/* if a plugin logs a message during shutdown, the queue may no longer exist */
+	if(pQueue == NULL) {
+		DBGPRINTF("submitMsg() could not submit message - "
+			  "queue does (no longer?) exist - ignored\n");
+		FINALIZE;
+	}
+
 	MsgPrepareEnqueue(pMsg);
 	qqueueEnqObj(pQueue, pMsg->flowCtlType, (void*) pMsg);
 
+finalize_it:
 	RETiRet;
 }
 
@@ -750,12 +758,20 @@ multiSubmitMsg(multi_submit_t *pMultiSub)
 	if(pMultiSub->nElem == 0)
 		FINALIZE;
 
+	pRuleset = MsgGetRuleset(pMultiSub->ppMsgs[0]);
+	pQueue = (pRuleset == NULL) ? pMsgQueue : ruleset.GetRulesetQueue(pRuleset);
+
+	/* if a plugin logs a message during shutdown, the queue may no longer exist */
+	if(pQueue == NULL) {
+		DBGPRINTF("multiSubmitMsg() could not submit message - "
+			  "queue does (no longer?) exist - ignored\n");
+		FINALIZE;
+	}
+
 	for(i = 0 ; i < pMultiSub->nElem ; ++i) {
 		MsgPrepareEnqueue(pMultiSub->ppMsgs[i]);
 	}
 
-	pRuleset = MsgGetRuleset(pMultiSub->ppMsgs[0]);
-	pQueue = (pRuleset == NULL) ? pMsgQueue : ruleset.GetRulesetQueue(pRuleset);
 	iRet = pQueue->MultiEnq(pQueue, pMultiSub);
 	pMultiSub->nElem = 0;
 
-- 
cgit