From d9bba4bb76b80a8d367730af6c8fd95180f76cec Mon Sep 17 00:00:00 2001 From: bluhm Date: Fri, 3 Sep 2021 23:57:30 +0000 Subject: [PATCH] Make sure that strings passed to printline() are always NUL terminated. There was a corner case with a very long message received over TCP or TLS where this was not clear. Force a '\0' where this line is truncated. OK martijn@ deraadt@ --- usr.sbin/syslogd/syslogd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/usr.sbin/syslogd/syslogd.c b/usr.sbin/syslogd/syslogd.c index 8632f29bc25..48b6d8c045a 100644 --- a/usr.sbin/syslogd/syslogd.c +++ b/usr.sbin/syslogd/syslogd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: syslogd.c,v 1.267 2021/09/03 16:28:33 bluhm Exp $ */ +/* $OpenBSD: syslogd.c,v 1.268 2021/09/03 23:57:30 bluhm Exp $ */ /* * Copyright (c) 2014-2017 Alexander Bluhm @@ -1309,6 +1309,7 @@ tcp_readcb(struct bufferevent *bufev, void *arg) /* Maximum frame has 5 digits, 1 space, MAXLINE chars, 1 new line. */ if (EVBUFFER_LENGTH(bufev->input) >= 5 + 1 + LOG_MAXLINE + 1) { log_debug(", use %zu bytes", EVBUFFER_LENGTH(bufev->input)); + EVBUFFER_DATA(bufev->input)[5 + 1 + LOG_MAXLINE] = '\0'; printline(p->p_hostname, EVBUFFER_DATA(bufev->input)); evbuffer_drain(bufev->input, -1); } else if (EVBUFFER_LENGTH(bufev->input) > 0) -- 2.20.1