From 2e74ca0f15d6d25568f5af1cc9cd30b4b01aa849 Mon Sep 17 00:00:00 2001

From: Jakub Filak <jfilak@redhat.com>

Date: Tue, 14 Oct 2014 03:15:28 +0200

Subject: [PATCH] journal-oops: use the length result of sd_journal_get_data()

journald doesn't guarantee NULL terminated strings returned from

sd_journal_get_data(). It usually works but not always.

This patch fixes the issue by using the length of field data instead of

assuming that string is NULL terminated.

Resolves: #1141549

Signed-off-by: Jakub Filak <jfilak@redhat.com>

---

 src/plugins/abrt-dump-journal-oops.c | 13 ++++++-----

 src/plugins/abrt-journal.c           | 43 ++++++++++++++++++++++--------------

 src/plugins/abrt-journal.h           |  8 ++++---

 3 files changed, 40 insertions(+), 24 deletions(-)

diff --git a/src/plugins/abrt-dump-journal-oops.c b/src/plugins/abrt-dump-journal-oops.c

index 3f1f419..0ff9fe0 100644

--- a/src/plugins/abrt-dump-journal-oops.c

+++ b/src/plugins/abrt-dump-journal-oops.c

@@ -38,8 +38,8 @@ static GList* abrt_journal_extract_kernel_oops(abrt_journal_t *journal)

     do

     {

-        const char *line = NULL;

-        if (abrt_journal_get_log_line(journal, &line) < 0)

+        char *line = abrt_journal_get_log_line(journal);

+        if (line == NULL)

             error_msg_and_die(_("Cannot read journal data."));

         if (lines_info_count == lines_info_size)

@@ -48,10 +48,13 @@ static GList* abrt_journal_extract_kernel_oops(abrt_journal_t *journal)

             lines_info = xrealloc(lines_info, lines_info_size * sizeof(lines_info[0]));

         }

-        lines_info[lines_info_count].level = koops_line_skip_level(&line);

-        koops_line_skip_jiffies(&line);

+        char *orig_line = line;

+        lines_info[lines_info_count].level = koops_line_skip_level((const char **)&line);

+        koops_line_skip_jiffies((const char **)&line);

-        lines_info[lines_info_count].ptr = xstrdup(line);

+        memmove(orig_line, line, strlen(line) + 1);

+

+        lines_info[lines_info_count].ptr = orig_line;

         ++lines_info_count;

     }

diff --git a/src/plugins/abrt-journal.c b/src/plugins/abrt-journal.c

index 89c8393..e0ae159 100644

--- a/src/plugins/abrt-journal.c

+++ b/src/plugins/abrt-journal.c

@@ -23,6 +23,12 @@

 #include <systemd/sd-journal.h>

+/*

+ * http://www.freedesktop.org/software/systemd/man/sd_journal_get_data.html

+ * sd_journal_set_data_threshold() : This threshold defaults to 64K by default.

+ */

+#define JOURNALD_MAX_FIELD_SIZE (64*1024)

+

 struct abrt_journal

 {

@@ -84,33 +90,38 @@ int abrt_journal_get_field(abrt_journal_t *journal, const char *field, const voi

     return 0;

 }

-int abrt_journal_get_string_field(abrt_journal_t *journal, const char *field, const char **value)

+char *abrt_journal_get_string_field(abrt_journal_t *journal, const char *field, char *value)

 {

-    size_t value_len;

-    const int r = abrt_journal_get_field(journal, field, (const void **)value, &value_len);

+    size_t data_len;

+    const char *data;

+    const int r = abrt_journal_get_field(journal, field, (const void **)&data, &data_len);

     if (r < 0)

     {

-        return r;

+        log_notice("Cannot read journal data");

+        return NULL;

     }

     const size_t pfx_len = strlen(field) + 1;

-    if (value_len < pfx_len)

+    if (data_len < pfx_len)

     {

         error_msg("Invalid data format from journal: field data are not prefixed with field name");

-        return -EBADMSG;

+        return NULL;

     }

-    *value += pfx_len;

-    return 0;

+    const size_t len = data_len - pfx_len;

+    if (value == NULL)

+        return xstrndup(data + pfx_len, len);

+    /*else*/

+

+    strncpy(value, data + pfx_len, len);

+    /* journal data are not NULL terminated strings, so terminate the string */

+    value[len] = '\0';

+    return value;

 }

-int abrt_journal_get_log_line(abrt_journal_t *journal, const char **line)

+char *abrt_journal_get_log_line(abrt_journal_t *journal)

 {

-    const int r = abrt_journal_get_string_field(journal, "MESSAGE", line);

-    if (r < 0)

-        log_notice("Cannot read journal data. Exiting");

-

-    return r;

+    return abrt_journal_get_string_field(journal, "MESSAGE", NULL);

 }

 int abrt_journal_get_cursor(abrt_journal_t *journal, char **cursor)

@@ -272,9 +283,9 @@ void abrt_journal_watch_notify_strings(abrt_journal_watch_t *watch, void *data)

 {

     struct abrt_journal_watch_notify_strings *conf = (struct abrt_journal_watch_notify_strings *)data;

-    const char *message = NULL;

+    char message[JOURNALD_MAX_FIELD_SIZE + 1];

-    if (abrt_journal_get_string_field(abrt_journal_watch_get_journal(watch), "MESSAGE", &message) < 0)

+    if (abrt_journal_get_string_field(abrt_journal_watch_get_journal(watch), "MESSAGE", (char *)message) == NULL)

         error_msg_and_die("Cannot read journal data.");

     GList *cur = conf->strings;

diff --git a/src/plugins/abrt-journal.h b/src/plugins/abrt-journal.h

index 219cf60..d509d96 100644

--- a/src/plugins/abrt-journal.h

+++ b/src/plugins/abrt-journal.h

@@ -40,11 +40,13 @@ int abrt_journal_get_field(abrt_journal_t *journal,

                            const void **value,

                            size_t *value_len);

-int abrt_journal_get_string_field(abrt_journal_t *journal,

+/* Returns allocated memory if value is NULL; otherwise makes copy of journald

+ * field to memory pointed by value arg. */

+char *abrt_journal_get_string_field(abrt_journal_t *journal,

                                   const char *field,

-                                  const char **value);

+                                  char *value);

-int abrt_journal_get_log_line(abrt_journal_t *journal, const char **line);

+char *abrt_journal_get_log_line(abrt_journal_t *journal);

 int abrt_journal_get_cursor(abrt_journal_t *journal, char **cursor);

-- 

2.1.0