From e892ba2195427ca0a12956fad8b83e0783b9569a Mon Sep 17 00:00:00 2001 From: Cropi Date: Wed, 22 Jul 2026 09:28:36 +0200 Subject: [PATCH] backport: imptcp regex-framing iCurrLine guard (RHEL-212704) Backport of local fix for the iCurrLine underflow crash in processDataRcvd_regexFraming(): when the oversize byte is '\n' the handler resets iMsg=0/iCurrLine=1 and the '\n' branch then sets both to 0. The next byte that matches the start regex computes iMsg = iCurrLine - 1 = -1, which as size_t is SIZE_MAX, crashing rsyslogd. Add the missing iCurrLine > 0 guard before the regex match branch, adapted for the rsyslog-8.2102.0 code base. Resolves: RHEL-212704 Signed-off-by: Cropi --- ...p-guard-iCurrLine-before-regex-match.patch | 33 +++++++++++++++++++ rsyslog.spec | 9 +++++ 2 files changed, 42 insertions(+) create mode 100644 RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch diff --git a/RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch b/RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch new file mode 100644 index 0000000..32b31d3 --- /dev/null +++ b/RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch @@ -0,0 +1,33 @@ +From ef8f1d90acedbf443eb3c152e67dcafb5d2149ec Mon Sep 17 00:00:00 2001 +From: Cropi +Date: Tue, 21 Jul 2026 14:29:06 +0200 +Subject: [PATCH] imptcp: guard regex-framing match against iCurrLine == 0 + +When the 2*iMaxLine-th byte processed is '\n', the oversize handler resets +iMsg=0 and iCurrLine=1, then the '\n' branch sets iCurrLine=iMsg=0. The +very next byte that matches the start regex computes iMsg = iCurrLine - 1 += -1, which is passed as size_t to MsgSetRawMsg yielding SIZE_MAX and +crashing rsyslogd (SIGABRT on assert, SIGSEGV on memcpy without it). + +Add the missing iCurrLine > 0 guard before the regex match branch, +mirroring the reference implementation in tcps_sess.c:516. With this +guard iMsg = iCurrLine - 1 is only reached when iCurrLine >= 1, so the +result is always non-negative. + +Signed-off-by: Cropi +--- + plugins/imptcp/imptcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/plugins/imptcp/imptcp.c b/plugins/imptcp/imptcp.c +index abc1234..def5678 100644 +--- a/plugins/imptcp/imptcp.c ++++ b/plugins/imptcp/imptcp.c +@@ -1037,7 +1037,7 @@ processDataRcvd_regexFraming(ptcpsess_t *const __restrict__ pThis, + } else { + const int isMatch = !regexec(&inst->start_preg, (char*)pThis->pMsg+pThis->iCurrLine, 0, NULL, 0); +- if(isMatch) { ++ if(pThis->iCurrLine > 0 && isMatch) { + DBGPRINTF("regex match (%d), framing line: %s\n", pThis->iCurrLine, pThis->pMsg); + strcpy((char*)pThis->pMsg_save, (char*) pThis->pMsg+pThis->iCurrLine); + pThis->iMsg = pThis->iCurrLine - 1; diff --git a/rsyslog.spec b/rsyslog.spec index 2341e34..e00ee89 100644 --- a/rsyslog.spec +++ b/rsyslog.spec @@ -78,6 +78,10 @@ Patch26: rsyslog-8.2102.0-rhbz2192955-es-6.patch Patch27: rsyslog-8.2102.0-rhbz2192955-es-doc.patch Patch28: propagate-gnutlsPriorityString.patch +# local commit: imptcp: guard regex-framing match against iCurrLine == 0 +# Resolves: RHEL-212704 +Patch29: RHEL-212704-imptcp-guard-iCurrLine-before-regex-match.patch + %package crypto Summary: Encryption support Group: System Environment/Daemons @@ -329,6 +333,7 @@ mv build doc %patch -P 26 -p1 %patch -P 27 -p1 %patch -P 28 -p1 +%patch -P 29 -p1 %build %ifarch sparc64 @@ -573,6 +578,10 @@ done %{_libdir}/rsyslog/omudpspoof.so %changelog +* Sun Aug 03 2026 Attila Lakatos - 8.2102.0-15.2 +- Backport: imptcp: guard regex-framing match against iCurrLine == 0 + Resolves: RHEL-212704 + * Mon Aug 26 2024 Attila Lakatos - 8.2102.0-15.1 - Propagate gnutlsPriorityString when accepting new connection resolves: RHEL-54663