From fc72c6cccc1e1e267c063e384a900a8987a8f14e Mon Sep 17 00:00:00 2001 From: Tomas Heinrich Date: Fri, 7 Jun 2013 01:15:10 +0200 Subject: bugfix: be more tolerant to malformed journal fields This prevents a segfault when a malformed journal entry field doesn't contain an equal sign. Should not ever happen but was actually triggered by a real bug in systemd journal. --- plugins/imjournal/imjournal.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'plugins/imjournal/imjournal.c') diff --git a/plugins/imjournal/imjournal.c b/plugins/imjournal/imjournal.c index ae29154d..cce45b9c 100755 --- a/plugins/imjournal/imjournal.c +++ b/plugins/imjournal/imjournal.c @@ -244,7 +244,14 @@ readjournal() { SD_JOURNAL_FOREACH_DATA(j, get, l) { /* locate equal sign, this is always present */ equal_sign = memchr(get, '=', l); - assert (equal_sign != NULL); + + /* ... but we know better than to trust the specs */ + if (equal_sign == NULL) { + errmsg.LogError(0, RS_RET_ERR,"SD_JOURNAL_FOREACH_DATA()" + " returned a malformed field (has no '='): '%s'", + get); + continue; /* skip the entry */ + } /* get length of journal data prefix */ prefixlen = ((char *)equal_sign - (char *)get); -- cgit v1.2.3