From 0082647fa5e6849b83ab4c6b9ab2e8803245db14 Mon Sep 17 00:00:00 2001
From: Tomas Heinrich <theinric@redhat.com>
Date: Fri, 7 Jun 2013 01:15:10 +0200
Subject: [PATCH] bugfix: be more tolerant to malformed journal fields
This prevents a segfault when a malformed journal entry field doesn't
contain an equal sign. Should not ever happen but was actually
triggered by a real bug in systemd journal.
---
plugins/imjournal/imjournal.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c
index ae29154..cce45b9 100755
--- a/plugins/imjournal/imjournal.c
+++ b/plugins/imjournal/imjournal.c
@@ -244,7 +244,14 @@ readjournal() {
SD_JOURNAL_FOREACH_DATA(j, get, l) {
/* locate equal sign, this is always present */
equal_sign = memchr(get, '=', l);
- assert (equal_sign != NULL);
+
+ /* ... but we know better than to trust the specs */
+ if (equal_sign == NULL) {
+ errmsg.LogError(0, RS_RET_ERR,"SD_JOURNAL_FOREACH_DATA()"
+ " returned a malformed field (has no '='): '%s'",
+ get);
+ continue; /* skip the entry */
+ }
/* get length of journal data prefix */
prefixlen = ((char *)equal_sign - (char *)get);
--
1.7.10.4