From 591e325904bbc908bd91c2d4fc9d9f793a5e9196 Mon Sep 17 00:00:00 2001 From: Cropi Date: Tue, 11 Aug 2026 08:29:55 +0200 Subject: [PATCH] backport: imptcp: guard regex framing match at line start Backport https://github.com/rsyslog/rsyslog/commit/07b3c40a5a78c79ed9109251f842ca7e955dd586 A regex match at the beginning of the receive buffer can form a negative message length after oversize-frame recovery. Mirror the line-offset guard used by the shared imtcp parser so that only a match following an existing line can submit a frame. Security advisory: GHSA-cj5r-wh2m-7w29 Resolves: RHEL-212706 Signed-off-by: Cropi --- imptcp-guard-regex-framing-at-line-start.patch | 11 +++++++++++ rsyslog.spec | 8 +++++++- 2 files changed, 18 insertions(+), 1 deletion(-) create mode 100644 imptcp-guard-regex-framing-at-line-start.patch diff --git a/imptcp-guard-regex-framing-at-line-start.patch b/imptcp-guard-regex-framing-at-line-start.patch new file mode 100644 index 0000000..54c63ad --- /dev/null +++ b/imptcp-guard-regex-framing-at-line-start.patch @@ -0,0 +1,11 @@ +--- rsyslog-8.2604.0/plugins/imptcp/imptcp.c 2026-04-20 11:25:09.423912802 +0200 ++++ rsyslog-8.2604.0-patched/plugins/imptcp/imptcp.c 2026-08-11 08:12:25.841724364 +0200 +@@ -1020,7 +1020,7 @@ static rsRetVal ATTR_NONNULL() processDa + pThis->iCurrLine = pThis->iMsg; + } else { + const int isMatch = !regexec(&inst->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0); +- if (isMatch) { ++ if (pThis->iCurrLine > 0 && isMatch) { + DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); + strcpy((char *)pThis->pMsg_save, (char *)pThis->pMsg + pThis->iCurrLine); + pThis->iMsg = pThis->iCurrLine - 1; diff --git a/rsyslog.spec b/rsyslog.spec index a56996d..ae89d3c 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -6,7 +6,7 @@ Summary: Enhanced system logging and kernel message trapping daemon Name: rsyslog Version: 8.2604.0 -Release: 3%{?dist} +Release: 4%{?dist} License: GPL-3.0-or-later AND Apache-2.0 URL: http://www.rsyslog.com/ Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz @@ -23,6 +23,7 @@ Patch0: imfile-inotify-fd-release-on-delete.patch Patch1: omelasticsearch-pqc-tls.patch Patch2: omelasticsearch-apply-tls-opts-during-detection.patch Patch3: imjournal-warn-on-missing-MESSAGE-field.patch +Patch4: imptcp-guard-regex-framing-at-line-start.patch BuildRequires: make BuildRequires: gcc @@ -249,6 +250,7 @@ container metadata. %patch -P 1 -p1 %patch -P 2 -p1 %patch -P 3 -p1 +%patch -P 4 -p1 # Unpack qpid-proton for rhel %setup -q -D -T -b 5 @@ -520,6 +522,10 @@ done %changelog +* Tue Aug 11 2026 Attila Lakatos - 8.2604.0-4 +- Backport: imptcp: guard regex framing match at line start + Resolves: RHEL-212706 + * Mon Jul 13 2026 Attila Lakatos - 8.2604.0-3 - Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry Resolves: RHEL-194529