diff options
| author | Rainer Gerhards <rgerhards@adiscon.com> | 2012-06-11 17:38:47 +0200 |
|---|---|---|
| committer | Rainer Gerhards <rgerhards@adiscon.com> | 2012-06-11 17:38:47 +0200 |
| commit | 85dea8048aed1b2d74eec57b30155898892daa37 (patch) | |
| tree | a8110a5fa6fa4bf14c20a7b2397aee138632cb24 | |
| parent | 27360bb33ff5e87a3852ebe2673170ebea168421 (diff) | |
| download | rsyslog-85dea8048aed1b2d74eec57b30155898892daa37.tar.gz rsyslog-85dea8048aed1b2d74eec57b30155898892daa37.tar.bz2 rsyslog-85dea8048aed1b2d74eec57b30155898892daa37.zip | |
bugfix: expression-based filters with AND/OR could segfault
due to a problem with boolean shortcut operations. From the user's
perspective, the segfault is almost non-deterministic (it occurs when
a shortcut is used).
Thanks to Lars Peterson for providing the initial bug report and his
support in solving it.
| -rw-r--r-- | ChangeLog | 8 | ||||
| -rw-r--r-- | grammar/rainerscript.c | 6 |
2 files changed, 12 insertions, 2 deletions
@@ -1,4 +1,12 @@ --------------------------------------------------------------------------- +Version 6.3.11 [BETA] 2012-06-?? +- bugfix: expression-based filters with AND/OR could segfault + due to a problem with boolean shortcut operations. From the user's + perspective, the segfault is almost non-deterministic (it occurs when + a shortcut is used). + Thanks to Lars Peterson for providing the initial bug report and his + support in solving it. +--------------------------------------------------------------------------- Version 6.3.10 [BETA] 2012-06-04 - bugfix: delayble source could block action queue, even if there was a disk queue associated with it. The root cause of this problem was diff --git a/grammar/rainerscript.c b/grammar/rainerscript.c index 66932c77..a5cc10c2 100644 --- a/grammar/rainerscript.c +++ b/grammar/rainerscript.c @@ -1129,8 +1129,9 @@ cnfexprEval(struct cnfexpr *expr, struct var *ret, void* usrptr) ret->d.n = 1ll; else ret->d.n = 0ll; + if(r.datatype == 'S') es_deleteStr(r.d.estr); } - FREE_BOTH_RET; + if(l.datatype == 'S') es_deleteStr(l.d.estr); break; case AND: cnfexprEval(expr->l, &l, usrptr); @@ -1141,10 +1142,11 @@ cnfexprEval(struct cnfexpr *expr, struct var *ret, void* usrptr) ret->d.n = 1ll; else ret->d.n = 0ll; + if(r.datatype == 'S') es_deleteStr(r.d.estr); } else { ret->d.n = 0ll; } - FREE_BOTH_RET; + if(l.datatype == 'S') es_deleteStr(l.d.estr); break; case NOT: cnfexprEval(expr->r, &r, usrptr); |