From 0082647fa5e6849b83ab4c6b9ab2e8803245db14 Mon Sep 17 00:00:00 2001 From: Tomas Heinrich Date: Fri, 7 Jun 2013 01:15:10 +0200 Subject: [PATCH] bugfix: be more tolerant to malformed journal fields This prevents a segfault when a malformed journal entry field doesn't contain an equal sign. Should not ever happen but was actually triggered by a real bug in systemd journal. --- plugins/imjournal/imjournal.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c index ae29154..cce45b9 100755 --- a/plugins/imjournal/imjournal.c +++ b/plugins/imjournal/imjournal.c @@ -244,7 +244,14 @@ readjournal() { SD_JOURNAL_FOREACH_DATA(j, get, l) { /* locate equal sign, this is always present */ equal_sign = memchr(get, '=', l); - assert (equal_sign != NULL); + + /* ... but we know better than to trust the specs */ + if (equal_sign == NULL) { + errmsg.LogError(0, RS_RET_ERR,"SD_JOURNAL_FOREACH_DATA()" + " returned a malformed field (has no '='): '%s'", + get); + continue; /* skip the entry */ + } /* get length of journal data prefix */ prefixlen = ((char *)equal_sign - (char *)get); -- 1.7.10.4