Skip to content

Commit

Permalink
journal: fix out-of-bounds read CVE-2018-16866
Browse files Browse the repository at this point in the history
The original code didn't account for the fact that strchr() would match on the
'\0' character, making it read past the end of the buffer if no non-whitespace
character was present.

This bug was introduced in commit ec5ff44 which was first released in
systemd v221 and later fixed in commit 8595102 which was released in
v240, so versions in the range [v221, v240) are affected.
  • Loading branch information
filbranden authored and keszybz committed Jan 14, 2019
1 parent 44b4dcb commit 33583cc
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion src/journal/journald-syslog.c
Original file line number Diff line number Diff line change
Expand Up @@ -238,7 +238,7 @@ size_t syslog_parse_identifier(const char **buf, char **identifier, char **pid)
if (t)
*identifier = t;

if (strchr(WHITESPACE, p[e]))
if (p[e] != '\0' && strchr(WHITESPACE, p[e]))
e++;
*buf = p + e;
return e;
Expand Down

0 comments on commit 33583cc

Please sign in to comment.