From 41d544a1c124a63f94b571e5ed924c4fb03193bb Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 9 Nov 2020 15:23:32 +0900 Subject: [PATCH] journal: refuse skip parameter for sd_journal_next_skip() larger than INT_MAX Fixes #17502. --- man/sd_journal_next.xml | 6 +++--- src/journal/sd-journal.c | 1 + 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/man/sd_journal_next.xml b/man/sd_journal_next.xml index 5f476fe3df..5608331737 100644 --- a/man/sd_journal_next.xml +++ b/man/sd_journal_next.xml @@ -78,9 +78,9 @@ the read pointer back one entry. sd_journal_next_skip() and - sd_journal_previous_skip() advance/set back - the read pointer by multiple entries at once, as specified in the - skip parameter. + sd_journal_previous_skip() advance/set back the read pointer by multiple + entries at once, as specified in the skip parameter. The skip + parameter must be less than or equal to 2147483647 (2^31-1). The journal is strictly ordered by reception time, and hence advancing to the next entry guarantees that the entry then diff --git a/src/journal/sd-journal.c b/src/journal/sd-journal.c index dbbf919b75..cb1ab88ca5 100644 --- a/src/journal/sd-journal.c +++ b/src/journal/sd-journal.c @@ -883,6 +883,7 @@ static int real_journal_next_skip(sd_journal *j, direction_t direction, uint64_t assert_return(j, -EINVAL); assert_return(!journal_pid_changed(j), -ECHILD); + assert_return(skip <= INT_MAX, -ERANGE); if (skip == 0) { /* If this is not a discrete skip, then at least