diff options
| author | Evgeny Vereshchagin <evvers@ya.ru> | 2018-11-16 23:32:31 +0100 |
|---|---|---|
| committer | Evgeny Vereshchagin <evvers@ya.ru> | 2018-11-17 11:25:19 +0100 |
| commit | 1dab14aba749b9c5ab8176c5730107b70834240b (patch) | |
| tree | 2b0ad3716c496f486756c48388c20badc6f9baf8 /src/journal | |
| parent | tests: add a fuzzer for process_audit_string (diff) | |
| download | systemd-1dab14aba749b9c5ab8176c5730107b70834240b.tar.xz systemd-1dab14aba749b9c5ab8176c5730107b70834240b.zip | |
journald: check whether sscanf has changed the value corresponding to %n
It's possible for sscanf to receive strings containing all three fields
and not matching the template at the same time. When this happens the
value of k doesn't change, which basically means that process_audit_string
tries to access memory randomly. Sometimes it works and sometimes it doesn't :-)
See also https://bugzilla.redhat.com/show_bug.cgi?id=1059314.
Diffstat (limited to 'src/journal')
| -rw-r--r-- | src/journal/journald-audit.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/journal/journald-audit.c b/src/journal/journald-audit.c index 94484f5d01..345e43ef44 100644 --- a/src/journal/journald-audit.c +++ b/src/journal/journald-audit.c @@ -341,11 +341,12 @@ void process_audit_string(Server *s, int type, const char *data, size_t size) { if (!p) return; + k = 0; if (sscanf(p, "(%" PRIu64 ".%" PRIu64 ":%" PRIu64 "):%n", &seconds, &msec, &id, - &k) != 3) + &k) != 3 || k == 0) return; p += k; |