50 lines
2.5 KiB
Diff
50 lines
2.5 KiB
Diff
From 85fbebe61a1aec2f86e36fb464283b6b55d3d76d Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
Date: Tue, 23 Jun 2020 20:51:13 +0200
|
|
Subject: [PATCH] journal: fix buffer overrun when urlifying
|
|
|
|
Fixes https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=21122.
|
|
|
|
message is only valid until message_len, and we need to make sure we're not
|
|
reading pass that. Bug introduced in 2108b56749ebb8d17f06d08b6ada2f79ae4f0.
|
|
---
|
|
src/shared/logs-show.c | 9 ++++++---
|
|
test/fuzz/fuzz-journal-remote/oss-fuzz-21122 | Bin 0 -> 35798 bytes
|
|
2 files changed, 6 insertions(+), 3 deletions(-)
|
|
create mode 100644 test/fuzz/fuzz-journal-remote/oss-fuzz-21122
|
|
|
|
diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
|
|
index 570377dc76..fee6ccdf2a 100644
|
|
--- a/src/shared/logs-show.c
|
|
+++ b/src/shared/logs-show.c
|
|
@@ -573,19 +573,22 @@ static int output_short(
|
|
if (config_file &&
|
|
message_len >= config_file_len &&
|
|
memcmp(message, config_file, config_file_len) == 0 &&
|
|
- IN_SET(message[config_file_len], ':', ' ', '\0') &&
|
|
+ (message_len == config_file_len || IN_SET(message[config_file_len], ':', ' ')) &&
|
|
(!highlight || highlight_shifted[0] == 0 || highlight_shifted[0] > config_file_len)) {
|
|
|
|
_cleanup_free_ char *t = NULL, *urlified = NULL;
|
|
|
|
t = strndup(config_file, config_file_len);
|
|
if (t && terminal_urlify_path(t, NULL, &urlified) >= 0) {
|
|
- size_t shift = strlen(urlified) - config_file_len;
|
|
+ size_t urlified_len = strlen(urlified);
|
|
+ size_t shift = urlified_len - config_file_len;
|
|
char *joined;
|
|
|
|
- joined = strjoin(urlified, message + config_file_len);
|
|
+ joined = realloc(urlified, message_len + shift);
|
|
if (joined) {
|
|
+ memcpy(joined + urlified_len, message + config_file_len, message_len - config_file_len);
|
|
free_and_replace(message, joined);
|
|
+ TAKE_PTR(urlified);
|
|
message_len += shift;
|
|
if (highlight) {
|
|
highlight_shifted[0] += shift;
|
|
|
|
--
|
|
2.23.0
|
|
|