rpms/rsyslog
7
0
Fork 0
Code Issues Pull Requests Releases Activity

backport: imptcp regex-framing iCurrLine guard (RHEL-212704)

Browse Source 
Backport of local fix for the iCurrLine underflow crash in
processDataRcvd_regexFraming(): when the oversize byte is '\n' the
handler resets iMsg=0/iCurrLine=1 and the '\n' branch then sets both
to 0. The next byte that matches the start regex computes
iMsg = iCurrLine - 1 = -1, which as size_t is SIZE_MAX, crashing
rsyslogd.

Add the missing iCurrLine > 0 guard before the regex match branch,
adapted for the rsyslog-8.2102.0 code base.

Resolves: RHEL-212704
Signed-off-by: Cropi <alakatos@redhat.com>
This commit is contained in:
Cropi 2026-07-22 09:28:36 +02:00 committed by Attila Lakatos
parent e6cf5e3e12
commit e892ba2195
2 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch Normal file
View File

@ -0,0 +1,33 @@
From ef8f1d90acedbf443eb3c152e67dcafb5d2149ec Mon Sep 17 00:00:00 2001
From: Cropi <alakatos@redhat.com>
Date: Tue, 21 Jul 2026 14:29:06 +0200
Subject: [PATCH] imptcp: guard regex-framing match against iCurrLine == 0
When the 2*iMaxLine-th byte processed is '\n', the oversize handler resets
iMsg=0 and iCurrLine=1, then the '\n' branch sets iCurrLine=iMsg=0. The
very next byte that matches the start regex computes iMsg = iCurrLine - 1
= -1, which is passed as size_t to MsgSetRawMsg yielding SIZE_MAX and
crashing rsyslogd (SIGABRT on assert, SIGSEGV on memcpy without it).
Add the missing iCurrLine > 0 guard before the regex match branch,
mirroring the reference implementation in tcps_sess.c:516. With this
guard iMsg = iCurrLine - 1 is only reached when iCurrLine >= 1, so the
result is always non-negative.
Signed-off-by: Cropi <alakatos@redhat.com>
---
plugins/imptcp/imptcp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c
index abc1234..def5678 100644
--- a/plugins/imptcp/imptcp.c
+++ b/plugins/imptcp/imptcp.c
@@ -1037,7 +1037,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis,
} else {
const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0);
- if(isMatch) {
+ if(pThis->iCurrLine > 0 && isMatch) {
DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg);
strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine);
pThis->iMsg = pThis->iCurrLine - 1;

9
rsyslog.spec
View File

@ -78,6 +78,10 @@ Patch26: rsyslog-8.2102.0-rhbz2192955-es-6.patch
Patch27: rsyslog-8.2102.0-rhbz2192955-es-doc.patch
Patch28: propagate-gnutlsPriorityString.patch
# local commit: imptcp: guard regex-framing match against iCurrLine == 0
# Resolves: RHEL-212704
Patch29: RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch
%package crypto
Summary: Encryption support
Group: System Environment/Daemons
@ -329,6 +333,7 @@ mv build doc
%patch -P 26 -p1
%patch -P 27 -p1
%patch -P 28 -p1
%patch -P 29 -p1
%build
%ifarch sparc64
@ -573,6 +578,10 @@ done
%{_libdir}/rsyslog/omudpspoof.so
%changelog
* Sun Aug 03 2026 Attila Lakatos <alakatos@redhat.com> - 8.2102.0-15.2
- Backport: imptcp: guard regex-framing match against iCurrLine == 0
Resolves: RHEL-212704
* Mon Aug 26 2024 Attila Lakatos <alakatos@redhat.com> - 8.2102.0-15.1
- Propagate gnutlsPriorityString when accepting new connection
resolves: RHEL-54663