rpms/rsyslog
7
0
Fork 0
Code Issues Pull Requests Releases Activity

backport: imptcp: guard regex framing match at line start

Browse Source 
Backport 07b3c40a5a

A regex match at the beginning of the receive buffer can form a
negative message length after oversize-frame recovery.  Mirror the
line-offset guard used by the shared imtcp parser so that only a
match following an existing line can submit a frame.

Resolves: RHEL-212698
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-08-11 08:20:27 +02:00
parent 3a93bc107e
commit e0c4a30e48
2 changed files with 18 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
imptcp-guard-regex-framing-at-line-start.patch Normal file
View File

@ -0,0 +1,11 @@
--- rsyslog-8.2604.0/plugins/imptcp/imptcp.c 2026-04-20 11:25:09.423912802 +0200
+++ rsyslog-8.2604.0-patched/plugins/imptcp/imptcp.c 2026-08-11 08:12:25.841724364 +0200
@@ -1020,7 +1020,7 @@ static rsRetVal ATTR_NONNULL() processDa
pThis->iCurrLine = pThis->iMsg;
} else {
const int isMatch = !regexec(&inst->start_preg, (char *)pThis->pMsg + pThis->iCurrLine, 0, NULL, 0);
- if (isMatch) {
+ if (pThis->iCurrLine > 0 && isMatch) {
DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
strcpy((char *)pThis->pMsg_save, (char *)pThis->pMsg + pThis->iCurrLine);
pThis->iMsg = pThis->iCurrLine - 1;

8
rsyslog.spec
View File

@ -39,7 +39,7 @@
Summary: Enhanced system logging and kernel message trapping daemon
Name: rsyslog
Version: 8.2604.0
Release: 4%{?dist}
Release: 5%{?dist}
License: GPL-3.0-or-later AND Apache-2.0
URL: http://www.rsyslog.com/
Source0: http://www.rsyslog.com/files/download/rsyslog/%{name}-%{version}.tar.gz
@ -56,6 +56,7 @@ Patch0: imfile-inotify-fd-release-on-delete.patch
Patch1: omelasticsearch-pqc-tls.patch
Patch2: omelasticsearch-apply-tls-opts-during-detection.patch
Patch3: imjournal-warn-on-missing-MESSAGE-field.patch
Patch4: imptcp-guard-regex-framing-at-line-start.patch
BuildRequires: make
BuildRequires: gcc
@ -394,6 +395,7 @@ This module allows rsyslog to send messages to a RabbitMQ server.
%patch -P1 -p1
%patch -P2 -p1
%patch -P3 -p1
%patch -P4 -p1
%if %{with omamqp1}
@ -789,6 +791,10 @@ done
%changelog
* Tue Aug 11 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-5
- Backport: imptcp: guard regex framing match at line start
Resolves: RHEL-212698
* Mon Jul 13 2026 Attila Lakatos <alakatos@redhat.com> - 8.2604.0-4
- Backport: warn when imjournal fails to retrieve MESSAGE field from journal entry
Resolves: RHEL-193508