From f112b51b8d6c358b87ac608112d393adb047ea0f Mon Sep 17 00:00:00 2001 From: Rainer Gerhards Date: Tue, 20 Dec 2011 16:39:39 +0100 Subject: bugfix: imuxsock did truncate part of received message if it did not contain a proper date. The truncation occured because we removed that part of the messages that was expected to be the date. closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295 --- ChangeLog | 4 ++++ plugins/imuxsock/imuxsock.c | 7 +++++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/ChangeLog b/ChangeLog index 26d6762a..3f5031ea 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,9 @@ --------------------------------------------------------------------------- Version 5.8.7 [V5-stable] 2011-??-?? +- bugfix: imuxsock did truncate part of received message if it did not + contain a proper date. The truncation occured because we removed that + part of the messages that was expected to be the date. + closes: http://bugzilla.adiscon.com/show_bug.cgi?id=295 - bugfix: potential abort after reading invalid X.509 certificate closes: http://bugzilla.adiscon.com/show_bug.cgi?id=290 Thanks to Tomas Heinrich for the patch diff --git a/plugins/imuxsock/imuxsock.c b/plugins/imuxsock/imuxsock.c index 2697c48a..feddb20c 100644 --- a/plugins/imuxsock/imuxsock.c +++ b/plugins/imuxsock/imuxsock.c @@ -565,8 +565,11 @@ SubmitMsg(uchar *pRcv, int lenRcv, lstn_t *pLstn, struct ucred *cred) parse++; lenMsg--; /* '>' */ if((pLstn->flags & IGNDATE)) { - parse += 16; /* just skip timestamp */ - lenMsg -= 16; + /* in this case, we still need to find out if we have a valid + * datestamp or not .. and advance the parse pointer accordingly. + */ + struct syslogTime dummy; + datetime.ParseTIMESTAMP3164(&dummy, &parse, &lenMsg); } else { if(datetime.ParseTIMESTAMP3164(&(pMsg->tTIMESTAMP), &parse, &lenMsg) != RS_RET_OK) { DBGPRINTF("we have a problem, invalid timestamp in msg!\n"); -- cgit