picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

journald: check whether sscanf has changed the value corresponding to %n 

It's possible for sscanf to receive strings containing all three fields
and not matching the template at the same time. When this happens the
value of k doesn't change, which basically means that process_audit_string
tries to access memory randomly. Sometimes it works and sometimes it doesn't :-)

See also https://bugzilla.redhat.com/show_bug.cgi?id=1059314.
This commit is contained in:
Evgeny Vereshchagin 2018-11-16 23:32:31 +01:00
parent 090a20cfaf
commit 1dab14aba7
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/journal/journald-audit.c
View File

@ -341,11 +341,12 @@ void process_audit_string(Server *s, int type, const char *data, size_t size) {
if (!p)
return;
k = 0;
if (sscanf(p, "(%" PRIu64 ".%" PRIu64 ":%" PRIu64 "):%n",
&seconds,
&msec,
&id,
&k) != 3)
&k) != 3 || k == 0)
return;
p += k;

1
test/fuzz/fuzz-journald-audit/crash Normal file
View File

@ -0,0 +1 @@
audit(1542398162.211:744) pid=7376 uid=1000 auid=1000 ses=6 subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="vagrant" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/1 res=success'