From 37ba1df6e37b2d020001f390ccb2462ae04fc9c1 Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Thu, 24 Sep 2009 09:48:38 +0200
Subject: bugfix: random data could be appended to message, possibly causing
 segfaults

---
 runtime/parser.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

(limited to 'runtime/parser.c')

diff --git a/runtime/parser.c b/runtime/parser.c
index 0b45bfd5..079bcf5e 100644
--- a/runtime/parser.c
+++ b/runtime/parser.c
@@ -274,6 +274,7 @@ finalize_it:
 	RETiRet;
 }
 
+
 /* Parse a received message. The object's rawmsg property is taken and
  * parsed according to the relevant standards. This can later be
  * extended to support configured parsers.
@@ -284,6 +285,7 @@ rsRetVal parseMsg(msg_t *pMsg)
 	DEFiRet;
 	uchar *msg;
 	int pri;
+	int lenMsg;
 	int iPriText;
 
 	CHKiRet(sanitizeMessage(pMsg));
@@ -292,8 +294,11 @@ rsRetVal parseMsg(msg_t *pMsg)
 	DBGPRINTF("msg parser: flags %x, from '%s', msg '%s'\n", pMsg->msgFlags, pMsg->pszRcvFrom, pMsg->pszRawMsg);
 
 	/* pull PRI */
-	pri = DEFUPRI;
+	lenMsg = pMsg->iLenRawMsg;
+	if(lenMsg == 0)
+		ABORT_FINALIZE(RS_RET_EMPTY_MSG);
 	msg = pMsg->pszRawMsg;
+	pri = DEFUPRI;
 	iPriText = 0;
 	if(*msg == '<') {
 		/* while we process the PRI, we also fill the PRI textual representation
@@ -301,7 +306,7 @@ rsRetVal parseMsg(msg_t *pMsg)
 		 * but it offers us performance...
 		 */
 		pri = 0;
-		while(isdigit((int) *++msg)) {
+		while(--lenMsg > 0 && isdigit((int) *++msg)) {
 			pMsg->bufPRI[iPriText++ % 4] = *msg;	 /* mod 4 to guard against malformed messages! */
 			pri = 10 * pri + (*msg - '0');
 		}
@@ -342,7 +347,7 @@ rsRetVal parseMsg(msg_t *pMsg)
 
 	/* finalize message object */
 	pMsg->msgFlags &= ~NEEDS_PARSING; /* this message is now parsed */
-	MsgPrepareEnqueue(pMsg); /* "historical" name - preparese for multi-threading */
+	MsgPrepareEnqueue(pMsg); /* "historical" name - prepare for multi-threading */
 
 finalize_it:
 	RETiRet;
-- 
cgit 


From 536415cf3dba053b0d2294b7f1dc8e34328e795f Mon Sep 17 00:00:00 2001
From: Rainer Gerhards <rgerhards@adiscon.com>
Date: Tue, 29 Sep 2009 14:22:11 +0200
Subject: bugfix: invalid handling of zero-sized messages

could lead to mis-addressing and potential memory corruption/segfault
---
 runtime/parser.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'runtime/parser.c')

diff --git a/runtime/parser.c b/runtime/parser.c
index 079bcf5e..7eff0801 100644
--- a/runtime/parser.c
+++ b/runtime/parser.c
@@ -167,6 +167,7 @@ sanitizeMessage(msg_t *pMsg)
 	size_t iMaxLine;
 
 	assert(pMsg != NULL);
+	assert(pMsg->iLenRawMsg > 0);
 
 #	ifdef USE_NETZIP
 	CHKiRet(uncompressMessage(pMsg));
@@ -288,6 +289,9 @@ rsRetVal parseMsg(msg_t *pMsg)
 	int lenMsg;
 	int iPriText;
 
+	if(pMsg->iLenRawMsg == 0)
+		ABORT_FINALIZE(RS_RET_EMPTY_MSG);
+
 	CHKiRet(sanitizeMessage(pMsg));
 
 	/* we needed to sanitize first, because we otherwise do not have a C-string we can print... */
@@ -295,8 +299,6 @@ rsRetVal parseMsg(msg_t *pMsg)
 
 	/* pull PRI */
 	lenMsg = pMsg->iLenRawMsg;
-	if(lenMsg == 0)
-		ABORT_FINALIZE(RS_RET_EMPTY_MSG);
 	msg = pMsg->pszRawMsg;
 	pri = DEFUPRI;
 	iPriText = 0;
-- 
cgit