From cb9761627630dc8aeafbbfcfe091f87b66b5a92a Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Thu, 1 Oct 2009 16:54:34 +0200
Subject: RFC5424 formatted messages with only structured data and no MSG part
 were improperly handled.

This was a regression of one of the last bugfixes, so no previously released
version contained this bug (thus it does not show up in the ChangeLog).
---
 runtime/datetime.c |  5 +++++
 runtime/rsyslog.h  |  2 +-
 tools/syslogd.c    | 16 ++++++++++++----
 3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/runtime/datetime.c b/runtime/datetime.c
index fc56b27c..99caaf97 100644
--- a/runtime/datetime.c
+++ b/runtime/datetime.c
@@ -213,18 +213,21 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS, int *pLenStr)
 	 */
 	if(lenStr == 0 || *pszTS++ != '-')
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
+	--lenStr;
 	month = srSLMGParseInt32(&pszTS, &lenStr);
 	if(month < 1 || month > 12)
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
 
 	if(lenStr == 0 || *pszTS++ != '-')
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
+	--lenStr;
 	day = srSLMGParseInt32(&pszTS, &lenStr);
 	if(day < 1 || day > 31)
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
 
 	if(lenStr == 0 || *pszTS++ != 'T')
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
+	--lenStr;
 
 	hour = srSLMGParseInt32(&pszTS, &lenStr);
 	if(hour < 0 || hour > 23)
@@ -232,12 +235,14 @@ ParseTIMESTAMP3339(struct syslogTime *pTime, uchar** ppszTS, int *pLenStr)
 
 	if(lenStr == 0 || *pszTS++ != ':')
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
+	--lenStr;
 	minute = srSLMGParseInt32(&pszTS, &lenStr);
 	if(minute < 0 || minute > 59)
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
 
 	if(lenStr == 0 || *pszTS++ != ':')
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
+	--lenStr;
 	second = srSLMGParseInt32(&pszTS, &lenStr);
 	if(second < 0 || second > 60)
 		ABORT_FINALIZE(RS_RET_INVLD_TIME);
diff --git a/runtime/rsyslog.h b/runtime/rsyslog.h
index 13b54731..835fff27 100644
--- a/runtime/rsyslog.h
+++ b/runtime/rsyslog.h
@@ -280,7 +280,7 @@ enum rsRetVal_				/** return value. All methods return this if not specified oth
 	RS_RET_ACTION_FAILED = -2123, /**< action failed and is now suspended (consider this permanent for the time being) */
 	RS_RET_NONFATAL_CONFIG_ERR = -2124, /**< non-fatal error during config processing */
 	RS_RET_FILENAME_INVALID = -2140, /**< filename invalid, not found, no access, ... */
-	RS_RET_EMPTY_MSG = -2141, /**< provided (raw) MSG is empty */
+	RS_RET_EMPTY_MSG = -2143, /**< provided (raw) MSG is empty */
 
 	/* RainerScript error messages (range 1000.. 1999) */
 	RS_RET_SYSVAR_NOT_FOUND = 1001, /**< system variable could not be found (maybe misspelled) */
diff --git a/tools/syslogd.c b/tools/syslogd.c
index 5671dcde..5f6b480f 100644
--- a/tools/syslogd.c
+++ b/tools/syslogd.c
@@ -1320,9 +1320,17 @@ static int parseRFCStructuredData(uchar **pp2parse, uchar *pResult, int *pLenStr
 	} else {
 		while(bCont) {
 			if(lenStr < 2) {
-				iRet = 1; /* this is not valid! */
-				bCont = 0;
-			} else if(*p2parse == '\\' && *(p2parse+1) == ']') {
+				/* we now need to check if we have only structured data */
+				if(lenStr > 0 && *p2parse == ']') {
+					*pResult++ = *p2parse;
+					p2parse++;
+					lenStr--;
+					bCont = 0;
+				} else {
+					iRet = 1; /* this is not valid! */
+					bCont = 0;
+				}
+  			} else if(*p2parse == '\\' && *(p2parse+1) == ']') {
 				/* this is escaped, need to copy both */
 				*pResult++ = *p2parse++;
 				*pResult++ = *p2parse++;
@@ -1382,7 +1390,7 @@ int parseRFCSyslogMsg(msg_t *pMsg, int flags)
 	assert(pMsg != NULL);
 	assert(pMsg->pszRawMsg != NULL);
 	p2parse = pMsg->pszRawMsg + pMsg->offAfterPRI; /* point to start of text, after PRI */
-	lenMsg = pMsg->iLenRawMsg - (pMsg->offAfterPRI + 1);
+	lenMsg = pMsg->iLenRawMsg - pMsg->offAfterPRI;
 
 	/* do a sanity check on the version and eat it (the caller checked this already) */
 	assert(p2parse[0] == '1' && p2parse[1] == ' ');
-- 
cgit