new file mode 100644
@@ -0,0 +1,67 @@
+From c6e7195075fd4fbd3db04e187f6d75030d17cb6b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 12:26:05 +0200
+Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ modules/syslogformat/syslog-format.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 38bb6f6..9042396 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data,
+ const guchar *src = *data;
+ gint left = *length;
+
++ if (!left)
++ return;
++
+ /* Cisco timestamp extensions, the first '*' indicates that the clock is
+ * unsynced, '.' if it is known to be synced */
+ if (G_UNLIKELY(src[0] == '*'))
+@@ -556,7 +559,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ open_sd++;
+ do
+ {
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+ /* read sd_id */
+ pos = 0;
+@@ -589,7 +592,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ sd_id_len = pos;
+ strcpy(sd_value_name, logmsg_sd_prefix);
+ strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
+- if (*src == ']')
++
++ if (left && *src == ']')
+ {
+ log_msg_set_value_by_name(self, sd_value_name, "", 0);
+ }
+@@ -606,7 +610,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ else
+ goto error;
+
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+
+ /* read sd-param */
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,152 @@
+From f8f985cd0902e0fa8306f988fb183f1987ab7d3b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 12:22:44 +0200
+Subject: [PATCH 2/8] syslogformat: add bug reproducer test for non-zero
+ terminated input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ modules/syslogformat/CMakeLists.txt | 1 +
+ modules/syslogformat/Makefile.am | 2 +
+ modules/syslogformat/tests/CMakeLists.txt | 1 +
+ modules/syslogformat/tests/Makefile.am | 9 +++
+ .../syslogformat/tests/test_syslog_format.c | 72 +++++++++++++++++++
+ 5 files changed, 85 insertions(+)
+ create mode 100644 modules/syslogformat/tests/CMakeLists.txt
+ create mode 100644 modules/syslogformat/tests/Makefile.am
+ create mode 100644 modules/syslogformat/tests/test_syslog_format.c
+
+diff --git a/modules/syslogformat/CMakeLists.txt b/modules/syslogformat/CMakeLists.txt
+index 94ee01a..64848ef 100644
+--- a/modules/syslogformat/CMakeLists.txt
++++ b/modules/syslogformat/CMakeLists.txt
+@@ -14,3 +14,4 @@ add_module(
+ SOURCES ${SYSLOGFORMAT_SOURCES}
+ )
+
++add_test_subdirectory(tests)
+diff --git a/modules/syslogformat/Makefile.am b/modules/syslogformat/Makefile.am
+index f13f88c..14cdf58 100644
+--- a/modules/syslogformat/Makefile.am
++++ b/modules/syslogformat/Makefile.am
+@@ -31,3 +31,5 @@ modules_syslogformat_libsyslogformat_la_DEPENDENCIES = \
+ modules/syslogformat modules/syslogformat/ mod-syslogformat: \
+ modules/syslogformat/libsyslogformat.la
+ .PHONY: modules/syslogformat/ mod-syslogformat
++
++include modules/syslogformat/tests/Makefile.am
+diff --git a/modules/syslogformat/tests/CMakeLists.txt b/modules/syslogformat/tests/CMakeLists.txt
+new file mode 100644
+index 0000000..2e45b71
+--- /dev/null
++++ b/modules/syslogformat/tests/CMakeLists.txt
+@@ -0,0 +1 @@
++add_unit_test(CRITERION TARGET test_syslog_format DEPENDS syslogformat)
+diff --git a/modules/syslogformat/tests/Makefile.am b/modules/syslogformat/tests/Makefile.am
+new file mode 100644
+index 0000000..7ee66a5
+--- /dev/null
++++ b/modules/syslogformat/tests/Makefile.am
+@@ -0,0 +1,9 @@
++modules_syslogformat_tests_TESTS = \
++ modules/syslogformat/tests/test_syslog_format
++
++check_PROGRAMS += ${modules_syslogformat_tests_TESTS}
++
++EXTRA_DIST += modules/syslogformat/tests/CMakeLists.txt
++
++modules_syslogformat_tests_test_syslog_format_CFLAGS = $(TEST_CFLAGS) -I$(top_srcdir)/modules/syslogformat
++modules_syslogformat_tests_test_syslog_format_LDADD = $(TEST_LDADD) $(PREOPEN_SYSLOGFORMAT)
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+new file mode 100644
+index 0000000..b247fe3
+--- /dev/null
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -0,0 +1,72 @@
++/*
++ * Copyright (c) 2022 One Identity
++ * Copyright (c) 2022 László Várady
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published
++ * by the Free Software Foundation, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
++ *
++ * As an additional exemption you are allowed to compile & link against the
++ * OpenSSL libraries as published by the OpenSSL project. See the file
++ * COPYING for details.
++ *
++ */
++
++#include <criterion/criterion.h>
++
++#include "apphook.h"
++#include "cfg.h"
++#include "syslog-format.h"
++#include "logmsg/logmsg.h"
++#include "msg-format.h"
++#include "scratch-buffers.h"
++
++#include <string.h>
++
++GlobalConfig *cfg;
++MsgFormatOptions parse_options;
++
++static void
++setup(void)
++{
++ app_startup();
++ syslog_format_init();
++
++ cfg = cfg_new_snippet();
++ msg_format_options_defaults(&parse_options);
++}
++
++static void
++teardown(void)
++{
++ scratch_buffers_explicit_gc();
++ app_shutdown();
++ cfg_free(cfg);
++}
++
++TestSuite(syslog_format, .init = setup, .fini = teardown);
++
++Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeout = 10)
++{
++ const gchar *data = "<182>2022-08-17T05:02:28.217 mymachine su: 'su root' failed for lonvick on /dev/pts/8";
++ /* chosen carefully to reproduce a bug */
++ gsize data_length = 27;
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,79 @@
+From 041ccdf8a4c73cd3138dac0611272361f384fb81 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sun, 21 Aug 2022 18:44:28 +0200
+Subject: [PATCH 3/8] syslogformat: fix reading cisco sequence id out of bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ modules/syslogformat/syslog-format.c | 2 +-
+ .../syslogformat/tests/test_syslog_format.c | 32 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 9042396..fe829fb 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -207,7 +207,7 @@ log_msg_parse_cisco_sequence_id(LogMessage *self, const guchar **data, gint *len
+
+ /* if the next char is not space, then we may try to read a date */
+
+- if (*src != ' ')
++ if (!left || *src != ' ')
+ return;
+
+ log_msg_set_value(self, handles.cisco_seqid, (gchar *) *data, *length - left - 1);
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+index b247fe3..d0f5b40 100644
+--- a/modules/syslogformat/tests/test_syslog_format.c
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -70,3 +70,35 @@ Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeou
+ msg_format_options_destroy(&parse_options);
+ log_msg_unref(msg);
+ }
++
++Test(syslog_format, cisco_sequence_id_non_zero_termination)
++{
++ const gchar *data = "<189>65536: ";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, ".SDATA.meta.sequenceId", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
++
++Test(syslog_format, minimal_non_zero_terminated_numeric_message_is_parsed_as_program_name)
++{
++ const gchar *data = "<189>65536";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, "PROGRAM", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,40 @@
+From bea4678261328c841b6062014394e6d3230a2fdb Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 12:42:38 +0200
+Subject: [PATCH 4/8] timeutils: fix iterating out of the range of timestamp
+ buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+Signed-off-by: Balazs Scheidler <bazsi77@gmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 2f6a6b7..cb6802d 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -328,7 +328,7 @@ __parse_usec(const guchar **data, gint *length)
+ src++;
+ (*length)--;
+ }
+- while (isdigit(*src))
++ while (*length > 0 && isdigit(*src))
+ {
+ src++;
+ (*length)--;
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,213 @@
+From 1f62031101608bee8ad772967eb8151aa33d6e1a Mon Sep 17 00:00:00 2001
+From: Balazs Scheidler <bazsi77@gmail.com>
+Date: Sat, 20 Aug 2022 12:43:42 +0200
+Subject: [PATCH 5/8] timeutils: add tests for non-zero terminated inputs
+
+Signed-off-by: Balazs Scheidler <bazsi77@gmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ lib/timeutils/tests/test_scan-timestamp.c | 126 +++++++++++++++++++---
+ 1 file changed, 113 insertions(+), 13 deletions(-)
+
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index 2756bf3..da375c8 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -49,17 +49,21 @@ fake_time_add(time_t diff)
+ }
+
+ static gboolean
+-_parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc3164(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
+-
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc3164_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -70,16 +74,21 @@ _parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc5424(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc5424_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -90,31 +99,60 @@ _parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_rfc3164_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc3164_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc3164(ts, converted));
++ cr_assert(_parse_rfc3164(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ static gboolean
+-_rfc5424_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc5424_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc5424(ts, converted));
++ cr_assert(_parse_rfc5424(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ #define _expect_rfc3164_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc3164_timestamp_eq(ts, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc3164_timestamp_eq(ts, -1, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc3164_timestamp_eq(ts, len, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc3164_timestamp(&data, &length, &wct)); \
+ })
+
+ #define _expect_rfc5424_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc5424_timestamp_eq(ts, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc5424_timestamp_eq(ts, -1, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc5424_timestamp_eq(ts, len, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc5424_timestamp(&data, &length, &wct)); \
+ })
+
++
+ Test(parse_timestamp, standard_bsd_format)
+ {
+ _expect_rfc3164_timestamp_eq("Oct 1 17:46:12", "2017-10-01T17:46:12.000+02:00");
+@@ -148,6 +186,68 @@ Test(parse_timestamp, standard_bsd_format_year_in_the_past)
+ _expect_rfc3164_timestamp_eq("Dec 31 17:46:12", "2017-12-31T17:46:12.000+01:00");
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc3164_iso_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc3164_bsd_pix_or_asa_input_is_handled_properly)
++{
++ gchar *ts = "Aug 17 2022 05:02:28: whatever";
++ gint ts_len = 21;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.000+02:00");
++
++ /* no ":" at the end, that's a problem, unrecognized */
++ _expect_rfc3164_fails(ts, ts_len - 1);
++
++ for (gint i = 1; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc5424_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc5424_fails(ts, ts_len - i);
++
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,182 @@
+From 14bcd1596f0f194b28e3f7babc75ad90d39ae7af Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 14:29:43 +0200
+Subject: [PATCH 6/8] timeutils: name repeating constant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 54 ++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index cb6802d..197e3ad 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -34,41 +34,43 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ {
+ *wday = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'S':
+- if (strncasecmp(*buf, "Sun", 3) == 0)
++ if (strncasecmp(*buf, "Sun", abbrev_length) == 0)
+ *wday = 0;
+- else if (strncasecmp(*buf, "Sat", 3) == 0)
++ else if (strncasecmp(*buf, "Sat", abbrev_length) == 0)
+ *wday = 6;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mon", 3) == 0)
++ if (strncasecmp(*buf, "Mon", abbrev_length) == 0)
+ *wday = 1;
+ else
+ return FALSE;
+ break;
+ case 'T':
+- if (strncasecmp(*buf, "Tue", 3) == 0)
++ if (strncasecmp(*buf, "Tue", abbrev_length) == 0)
+ *wday = 2;
+- else if (strncasecmp(*buf, "Thu", 3) == 0)
++ else if (strncasecmp(*buf, "Thu", abbrev_length) == 0)
+ *wday = 4;
+ else
+ return FALSE;
+ break;
+ case 'W':
+- if (strncasecmp(*buf, "Wed", 3) == 0)
++ if (strncasecmp(*buf, "Wed", abbrev_length) == 0)
+ *wday = 3;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Fri", 3) == 0)
++ if (strncasecmp(*buf, "Fri", abbrev_length) == 0)
+ *wday = 5;
+ else
+ return FALSE;
+@@ -77,8 +79,8 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+@@ -87,63 +89,65 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ {
+ *mon = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'J':
+- if (strncasecmp(*buf, "Jan", 3) == 0)
++ if (strncasecmp(*buf, "Jan", abbrev_length) == 0)
+ *mon = 0;
+- else if (strncasecmp(*buf, "Jun", 3) == 0)
++ else if (strncasecmp(*buf, "Jun", abbrev_length) == 0)
+ *mon = 5;
+- else if (strncasecmp(*buf, "Jul", 3) == 0)
++ else if (strncasecmp(*buf, "Jul", abbrev_length) == 0)
+ *mon = 6;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Feb", 3) == 0)
++ if (strncasecmp(*buf, "Feb", abbrev_length) == 0)
+ *mon = 1;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mar", 3) == 0)
++ if (strncasecmp(*buf, "Mar", abbrev_length) == 0)
+ *mon = 2;
+- else if (strncasecmp(*buf, "May", 3) == 0)
++ else if (strncasecmp(*buf, "May", abbrev_length) == 0)
+ *mon = 4;
+ else
+ return FALSE;
+ break;
+ case 'A':
+- if (strncasecmp(*buf, "Apr", 3) == 0)
++ if (strncasecmp(*buf, "Apr", abbrev_length) == 0)
+ *mon = 3;
+- else if (strncasecmp(*buf, "Aug", 3) == 0)
++ else if (strncasecmp(*buf, "Aug", abbrev_length) == 0)
+ *mon = 7;
+ else
+ return FALSE;
+ break;
+ case 'S':
+- if (strncasecmp(*buf, "Sep", 3) == 0)
++ if (strncasecmp(*buf, "Sep", abbrev_length) == 0)
+ *mon = 8;
+ else
+ return FALSE;
+ break;
+ case 'O':
+- if (strncasecmp(*buf, "Oct", 3) == 0)
++ if (strncasecmp(*buf, "Oct", abbrev_length) == 0)
+ *mon = 9;
+ else
+ return FALSE;
+ break;
+ case 'N':
+- if (strncasecmp(*buf, "Nov", 3) == 0)
++ if (strncasecmp(*buf, "Nov", abbrev_length) == 0)
+ *mon = 10;
+ else
+ return FALSE;
+ break;
+ case 'D':
+- if (strncasecmp(*buf, "Dec", 3) == 0)
++ if (strncasecmp(*buf, "Dec", abbrev_length) == 0)
+ *mon = 11;
+ else
+ return FALSE;
+@@ -152,8 +156,8 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,84 @@
+From d4c8ba0c513052b5f19c6e989ba31f847f4900d1 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 14:30:22 +0200
+Subject: [PATCH 7/8] timeutils: fix invalid calculation of ISO timestamp
+ length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 8 ++++++--
+ lib/timeutils/tests/test_scan-timestamp.c | 7 +++++++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 197e3ad..4e618e4 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -346,19 +346,21 @@ __parse_usec(const guchar **data, gint *length)
+ static gboolean
+ __has_iso_timezone(const guchar *src, gint length)
+ {
+- return (length >= 5) &&
++ return (length >= 6) &&
+ (*src == '+' || *src == '-') &&
+ isdigit(*(src+1)) &&
+ isdigit(*(src+2)) &&
+ *(src+3) == ':' &&
+ isdigit(*(src+4)) &&
+ isdigit(*(src+5)) &&
+- !isdigit(*(src+6));
++ (length < 7 || !isdigit(*(src+6)));
+ }
+
+ static guint32
+ __parse_iso_timezone(const guchar **data, gint *length)
+ {
++ g_assert(*length >= 6);
++
+ gint hours, mins;
+ const guchar *src = *data;
+ guint32 tz = 0;
+@@ -368,8 +370,10 @@ __parse_iso_timezone(const guchar **data, gint *length)
+ hours = (*(src + 1) - '0') * 10 + *(src + 2) - '0';
+ mins = (*(src + 4) - '0') * 10 + *(src + 5) - '0';
+ tz = sign * (hours * 3600 + mins * 60);
++
+ src += 6;
+ (*length) -= 6;
++
+ *data = src;
+ return tz;
+ }
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index da375c8..9b38738 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -248,6 +248,13 @@ Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
+
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc5424_timestamp_only)
++{
++ const gchar *ts = "2022-08-17T05:02:28.417+03:00";
++ gint ts_len = strlen(ts);
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, ts);
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,47 @@
+From f60dcfa9e094dc9c2a752115ca426159c4ae4192 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 14:30:51 +0200
+Subject: [PATCH 8/8] timeutils: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 4e618e4..0f7f52e 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -427,7 +427,7 @@ __parse_bsd_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ if (!scan_pix_timestamp((const gchar **) &src, &left, wct))
+ return FALSE;
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ src++;
+ left--;
+@@ -478,7 +478,7 @@ scan_rfc3164_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ * looking at you, skip that as well, so we can reliably detect IPv6
+ * addresses as hostnames, which would be using ":" as well. */
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ ++src;
+ --left;
+--
+2.37.3
+
+
@@ -22,6 +22,14 @@ SRC_URI = "https://github.com/balabit/syslog-ng/releases/download/${BP}/${BP}.ta
file://volatiles.03_syslog-ng \
file://syslog-ng-tmp.conf \
file://syslog-ng.service-the-syslog-ng-service.patch \
+ file://CVE-2022-38725-0001.patch \
+ file://CVE-2022-38725-0002.patch \
+ file://CVE-2022-38725-0003.patch \
+ file://CVE-2022-38725-0004.patch \
+ file://CVE-2022-38725-0005.patch \
+ file://CVE-2022-38725-0006.patch \
+ file://CVE-2022-38725-0007.patch \
+ file://CVE-2022-38725-0008.patch \
"
SRC_URI[sha256sum] = "90a25c9767fe749db50f118ddfc92ec71399763d2ecd5ad4f11ff5eea049e60b"
--
2.34.1
Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows
From: MacLeod, Randy<mailto:Randy.MacLeod@windriver.com>
Sent: 24 November 2022 03:16
To: Urade, Yogita<mailto:Yogita.Urade@windriver.com>; openembedded-devel@lists.openembedded.org<mailto:openembedded-devel@lists.openembedded.org>
Cc: G Pillai, Hari<mailto:Hari.GPillai@windriver.com>; Mali, Narpat<mailto:Narpat.Mali@windriver.com>
Subject: Re: [oe] [meta-openembedded][kirkstone][PATCH 1/1] syslog-ng: fix CVE-2022-38725
Hi Yogita,
On 2022-11-21 05:29, Urade, Yogita via lists.openembedded.org wrote:
Issue: LIN1022-1598
The line above is only for internal WR reviews, please drop.
Fix buffer handling of syslog and timestamp parsers.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-38725
https://github.com/syslog-ng/syslog-ng/releases
https://github.com/syslog-ng/syslog-ng/pull/4110
Upstream patches:
https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
(LOCAL REV: NOT UPSTREAM) -- Not applicable, upstream out of maintenance
The line above is only for internal WR reviews, please drop.
Also, this is the upstream for WR Linux, so it's not out of maintenance! ;-)
Other than that, this looks good.
Please send a v2.
Thanks,
../Randy
Signed-off-by: Yogita Urade <yogita.urade@windriver.com><mailto:yogita.urade@windriver.com>
---
.../syslog-ng/files/CVE-2022-38725-0001.patch | 67 ++++++
.../syslog-ng/files/CVE-2022-38725-0002.patch | 152 +++++++++++++
.../syslog-ng/files/CVE-2022-38725-0003.patch | 79 +++++++
.../syslog-ng/files/CVE-2022-38725-0004.patch | 40 ++++
.../syslog-ng/files/CVE-2022-38725-0005.patch | 213 ++++++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0006.patch | 182 +++++++++++++++
.../syslog-ng/files/CVE-2022-38725-0007.patch | 84 +++++++
.../syslog-ng/files/CVE-2022-38725-0008.patch | 47 ++++
.../syslog-ng/syslog-ng_3.36.1.bb | 8 +
9 files changed, 872 insertions(+)
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch
create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch
new file mode 100644
@@ -0,0 +1,67 @@
+From c6e7195075fd4fbd3db04e187f6d75030d17cb6b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 12:26:05 +0200
+Subject: [PATCH 1/8] syslogformat: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ modules/syslogformat/syslog-format.c | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 38bb6f6..9042396 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -223,6 +223,9 @@ log_msg_parse_cisco_timestamp_attributes(LogMessage *self, const guchar **data,
+ const guchar *src = *data;
+ gint left = *length;
+
++ if (!left)
++ return;
++
+ /* Cisco timestamp extensions, the first '*' indicates that the clock is
+ * unsynced, '.' if it is known to be synced */
+ if (G_UNLIKELY(src[0] == '*'))
+@@ -556,7 +559,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ open_sd++;
+ do
+ {
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+ /* read sd_id */
+ pos = 0;
+@@ -589,7 +592,8 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ sd_id_len = pos;
+ strcpy(sd_value_name, logmsg_sd_prefix);
+ strncpy(sd_value_name + logmsg_sd_prefix_len, sd_id_name, sizeof(sd_value_name) - logmsg_sd_prefix_len);
+- if (*src == ']')
++
++ if (left && *src == ']')
+ {
+ log_msg_set_value_by_name(self, sd_value_name, "", 0);
+ }
+@@ -606,7 +610,7 @@ log_msg_parse_sd(LogMessage *self, const guchar **data, gint *length, const MsgF
+ else
+ goto error;
+
+- if (!isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
++ if (!left || !isascii(*src) || *src == '=' || *src == ' ' || *src == ']' || *src == '"')
+ goto error;
+
+ /* read sd-param */
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,152 @@
+From f8f985cd0902e0fa8306f988fb183f1987ab7d3b Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 12:22:44 +0200
+Subject: [PATCH 2/8] syslogformat: add bug reproducer test for non-zero
+ terminated input
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ modules/syslogformat/CMakeLists.txt | 1 +
+ modules/syslogformat/Makefile.am | 2 +
+ modules/syslogformat/tests/CMakeLists.txt | 1 +
+ modules/syslogformat/tests/Makefile.am | 9 +++
+ .../syslogformat/tests/test_syslog_format.c | 72 +++++++++++++++++++
+ 5 files changed, 85 insertions(+)
+ create mode 100644 modules/syslogformat/tests/CMakeLists.txt
+ create mode 100644 modules/syslogformat/tests/Makefile.am
+ create mode 100644 modules/syslogformat/tests/test_syslog_format.c
+
+diff --git a/modules/syslogformat/CMakeLists.txt b/modules/syslogformat/CMakeLists.txt
+index 94ee01a..64848ef 100644
+--- a/modules/syslogformat/CMakeLists.txt
++++ b/modules/syslogformat/CMakeLists.txt
+@@ -14,3 +14,4 @@ add_module(
+ SOURCES ${SYSLOGFORMAT_SOURCES}
+ )
+
++add_test_subdirectory(tests)
+diff --git a/modules/syslogformat/Makefile.am b/modules/syslogformat/Makefile.am
+index f13f88c..14cdf58 100644
+--- a/modules/syslogformat/Makefile.am
++++ b/modules/syslogformat/Makefile.am
+@@ -31,3 +31,5 @@ modules_syslogformat_libsyslogformat_la_DEPENDENCIES = \
+ modules/syslogformat modules/syslogformat/ mod-syslogformat: \
+ modules/syslogformat/libsyslogformat.la
+ .PHONY: modules/syslogformat/ mod-syslogformat
++
++include modules/syslogformat/tests/Makefile.am
+diff --git a/modules/syslogformat/tests/CMakeLists.txt b/modules/syslogformat/tests/CMakeLists.txt
+new file mode 100644
+index 0000000..2e45b71
+--- /dev/null
++++ b/modules/syslogformat/tests/CMakeLists.txt
+@@ -0,0 +1 @@
++add_unit_test(CRITERION TARGET test_syslog_format DEPENDS syslogformat)
+diff --git a/modules/syslogformat/tests/Makefile.am b/modules/syslogformat/tests/Makefile.am
+new file mode 100644
+index 0000000..7ee66a5
+--- /dev/null
++++ b/modules/syslogformat/tests/Makefile.am
+@@ -0,0 +1,9 @@
++modules_syslogformat_tests_TESTS = \
++ modules/syslogformat/tests/test_syslog_format
++
++check_PROGRAMS += ${modules_syslogformat_tests_TESTS}
++
++EXTRA_DIST += modules/syslogformat/tests/CMakeLists.txt
++
++modules_syslogformat_tests_test_syslog_format_CFLAGS = $(TEST_CFLAGS) -I$(top_srcdir)/modules/syslogformat
++modules_syslogformat_tests_test_syslog_format_LDADD = $(TEST_LDADD) $(PREOPEN_SYSLOGFORMAT)
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+new file mode 100644
+index 0000000..b247fe3
+--- /dev/null
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -0,0 +1,72 @@
++/*
++ * Copyright (c) 2022 One Identity
++ * Copyright (c) 2022 László Várady
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 as published
++ * by the Free Software Foundation, or (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License
++ * along with this program; if not, write to the Free Software
++ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
++ *
++ * As an additional exemption you are allowed to compile & link against the
++ * OpenSSL libraries as published by the OpenSSL project. See the file
++ * COPYING for details.
++ *
++ */
++
++#include <criterion/criterion.h>
++
++#include "apphook.h"
++#include "cfg.h"
++#include "syslog-format.h"
++#include "logmsg/logmsg.h"
++#include "msg-format.h"
++#include "scratch-buffers.h"
++
++#include <string.h>
++
++GlobalConfig *cfg;
++MsgFormatOptions parse_options;
++
++static void
++setup(void)
++{
++ app_startup();
++ syslog_format_init();
++
++ cfg = cfg_new_snippet();
++ msg_format_options_defaults(&parse_options);
++}
++
++static void
++teardown(void)
++{
++ scratch_buffers_explicit_gc();
++ app_shutdown();
++ cfg_free(cfg);
++}
++
++TestSuite(syslog_format, .init = setup, .fini = teardown);
++
++Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeout = 10)
++{
++ const gchar *data = "<182>2022-08-17T05:02:28.217 mymachine su: 'su root' failed for lonvick on /dev/pts/8";
++ /* chosen carefully to reproduce a bug */
++ gsize data_length = 27;
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,79 @@
+From 041ccdf8a4c73cd3138dac0611272361f384fb81 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sun, 21 Aug 2022 18:44:28 +0200
+Subject: [PATCH 3/8] syslogformat: fix reading cisco sequence id out of bounds
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ modules/syslogformat/syslog-format.c | 2 +-
+ .../syslogformat/tests/test_syslog_format.c | 32 +++++++++++++++++++
+ 2 files changed, 33 insertions(+), 1 deletion(-)
+
+diff --git a/modules/syslogformat/syslog-format.c b/modules/syslogformat/syslog-format.c
+index 9042396..fe829fb 100644
+--- a/modules/syslogformat/syslog-format.c
++++ b/modules/syslogformat/syslog-format.c
+@@ -207,7 +207,7 @@ log_msg_parse_cisco_sequence_id(LogMessage *self, const guchar **data, gint *len
+
+ /* if the next char is not space, then we may try to read a date */
+
+- if (*src != ' ')
++ if (!left || *src != ' ')
+ return;
+
+ log_msg_set_value(self, handles.cisco_seqid, (gchar *) *data, *length - left - 1);
+diff --git a/modules/syslogformat/tests/test_syslog_format.c b/modules/syslogformat/tests/test_syslog_format.c
+index b247fe3..d0f5b40 100644
+--- a/modules/syslogformat/tests/test_syslog_format.c
++++ b/modules/syslogformat/tests/test_syslog_format.c
+@@ -70,3 +70,35 @@ Test(syslog_format, parser_should_not_spin_on_non_zero_terminated_input, .timeou
+ msg_format_options_destroy(&parse_options);
+ log_msg_unref(msg);
+ }
++
++Test(syslog_format, cisco_sequence_id_non_zero_termination)
++{
++ const gchar *data = "<189>65536: ";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, ".SDATA.meta.sequenceId", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
++
++Test(syslog_format, minimal_non_zero_terminated_numeric_message_is_parsed_as_program_name)
++{
++ const gchar *data = "<189>65536";
++ gsize data_length = strlen(data);
++
++ msg_format_options_init(&parse_options, cfg);
++ LogMessage *msg = msg_format_construct_message(&parse_options, (const guchar *) data, data_length);
++
++ gsize problem_position;
++ cr_assert(syslog_format_handler(&parse_options, msg, (const guchar *) data, data_length, &problem_position));
++ cr_assert_str_eq(log_msg_get_value_by_name(msg, "PROGRAM", NULL), "65536");
++
++ msg_format_options_destroy(&parse_options);
++ log_msg_unref(msg);
++}
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,40 @@
+From bea4678261328c841b6062014394e6d3230a2fdb Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 12:42:38 +0200
+Subject: [PATCH 4/8] timeutils: fix iterating out of the range of timestamp
+ buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Signed-off-by: Balazs Scheidler <bazsi77@gmail.com><mailto:bazsi77@gmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 2f6a6b7..cb6802d 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -328,7 +328,7 @@ __parse_usec(const guchar **data, gint *length)
+ src++;
+ (*length)--;
+ }
+- while (isdigit(*src))
++ while (*length > 0 && isdigit(*src))
+ {
+ src++;
+ (*length)--;
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,213 @@
+From 1f62031101608bee8ad772967eb8151aa33d6e1a Mon Sep 17 00:00:00 2001
+From: Balazs Scheidler <bazsi77@gmail.com><mailto:bazsi77@gmail.com>
+Date: Sat, 20 Aug 2022 12:43:42 +0200
+Subject: [PATCH 5/8] timeutils: add tests for non-zero terminated inputs
+
+Signed-off-by: Balazs Scheidler <bazsi77@gmail.com><mailto:bazsi77@gmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ lib/timeutils/tests/test_scan-timestamp.c | 126 +++++++++++++++++++---
+ 1 file changed, 113 insertions(+), 13 deletions(-)
+
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index 2756bf3..da375c8 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -49,17 +49,21 @@ fake_time_add(time_t diff)
+ }
+
+ static gboolean
+-_parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc3164(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
+-
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc3164_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -70,16 +74,21 @@ _parse_rfc3164(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
++_parse_rfc5424(const gchar *ts, gint len, gchar isotimestamp[32])
+ {
+ UnixTime stamp;
+- const guchar *data = (const guchar *) ts;
+- gint length = strlen(ts);
++ const guchar *tsu = (const guchar *) ts;
++ gint tsu_len = len < 0 ? strlen(ts) : len;
+ GString *result = g_string_new("");
+ WallClockTime wct = WALL_CLOCK_TIME_INIT;
+
++ const guchar *data = tsu;
++ gint length = tsu_len;
+ gboolean success = scan_rfc5424_timestamp(&data, &length, &wct);
+
++ cr_assert(length >= 0);
++ cr_assert(data == &tsu[tsu_len - length]);
++
+ unix_time_unset(&stamp);
+ convert_wall_clock_time_to_unix_time(&wct, &stamp);
+
+@@ -90,31 +99,60 @@ _parse_rfc5424(const gchar *ts, gchar isotimestamp[32])
+ }
+
+ static gboolean
+-_rfc3164_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc3164_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc3164(ts, converted));
++ cr_assert(_parse_rfc3164(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ static gboolean
+-_rfc5424_timestamp_eq(const gchar *ts, const gchar *expected, gchar converted[32])
++_rfc5424_timestamp_eq(const gchar *ts, gint len, const gchar *expected, gchar converted[32])
+ {
+- cr_assert(_parse_rfc5424(ts, converted));
++ cr_assert(_parse_rfc5424(ts, len, converted));
+ return strcmp(converted, expected) == 0;
+ }
+
+ #define _expect_rfc3164_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc3164_timestamp_eq(ts, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc3164_timestamp_eq(ts, -1, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc3164_timestamp_eq(ts, len, expected, converted), "Parsed RFC3164 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc3164_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc3164_timestamp(&data, &length, &wct)); \
+ })
+
+ #define _expect_rfc5424_timestamp_eq(ts, expected) \
+ ({ \
+ gchar converted[32]; \
+- cr_expect(_rfc5424_timestamp_eq(ts, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ cr_expect(_rfc5424_timestamp_eq(ts, -1, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_timestamp_len_eq(ts, len, expected) \
++ ({ \
++ gchar converted[32]; \
++ cr_expect(_rfc5424_timestamp_eq(ts, len, expected, converted), "Parsed RFC5424 timestamp does not equal expected, ts=%s, converted=%s, expected=%s", ts, converted, expected); \
++ })
++
++#define _expect_rfc5424_fails(ts, len) \
++ ({ \
++ WallClockTime wct = WALL_CLOCK_TIME_INIT; \
++ const guchar *data = (guchar *) ts; \
++ gint length = len < 0 ? strlen(ts) : len; \
++ cr_assert_not(scan_rfc5424_timestamp(&data, &length, &wct)); \
+ })
+
++
+ Test(parse_timestamp, standard_bsd_format)
+ {
+ _expect_rfc3164_timestamp_eq("Oct 1 17:46:12", "2017-10-01T17:46:12.000+02:00");
+@@ -148,6 +186,68 @@ Test(parse_timestamp, standard_bsd_format_year_in_the_past)
+ _expect_rfc3164_timestamp_eq("Dec 31 17:46:12", "2017-12-31T17:46:12.000+01:00");
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc3164_iso_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc3164_bsd_pix_or_asa_input_is_handled_properly)
++{
++ gchar *ts = "Aug 17 2022 05:02:28: whatever";
++ gint ts_len = 21;
++
++ _expect_rfc3164_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc3164_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.000+02:00");
++
++ /* no ":" at the end, that's a problem, unrecognized */
++ _expect_rfc3164_fails(ts, ts_len - 1);
++
++ for (gint i = 1; i < ts_len; i++)
++ _expect_rfc3164_fails(ts, ts_len - i);
++}
++
++Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
++{
++ gchar *ts = "2022-08-17T05:02:28.417Z whatever";
++ gint ts_len = 24;
++
++ _expect_rfc5424_timestamp_len_eq(ts, strlen(ts), "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len + 5, "2022-08-17T05:02:28.417+00:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, "2022-08-17T05:02:28.417+00:00");
++
++ /* no "Z" parsed, timezone defaults to local, forced CET */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 1, "2022-08-17T05:02:28.417+02:00");
++
++ /* msec is partially parsed as we trim the string from the right */
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 2, "2022-08-17T05:02:28.410+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 3, "2022-08-17T05:02:28.400+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 4, "2022-08-17T05:02:28.000+02:00");
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len - 5, "2022-08-17T05:02:28.000+02:00");
++
++ for (gint i = 6; i < ts_len; i++)
++ _expect_rfc5424_fails(ts, ts_len - i);
++
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,182 @@
+From 14bcd1596f0f194b28e3f7babc75ad90d39ae7af Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 14:29:43 +0200
+Subject: [PATCH 6/8] timeutils: name repeating constant
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 54 ++++++++++++++++++----------------
+ 1 file changed, 29 insertions(+), 25 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index cb6802d..197e3ad 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -34,41 +34,43 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ {
+ *wday = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'S':
+- if (strncasecmp(*buf, "Sun", 3) == 0)
++ if (strncasecmp(*buf, "Sun", abbrev_length) == 0)
+ *wday = 0;
+- else if (strncasecmp(*buf, "Sat", 3) == 0)
++ else if (strncasecmp(*buf, "Sat", abbrev_length) == 0)
+ *wday = 6;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mon", 3) == 0)
++ if (strncasecmp(*buf, "Mon", abbrev_length) == 0)
+ *wday = 1;
+ else
+ return FALSE;
+ break;
+ case 'T':
+- if (strncasecmp(*buf, "Tue", 3) == 0)
++ if (strncasecmp(*buf, "Tue", abbrev_length) == 0)
+ *wday = 2;
+- else if (strncasecmp(*buf, "Thu", 3) == 0)
++ else if (strncasecmp(*buf, "Thu", abbrev_length) == 0)
+ *wday = 4;
+ else
+ return FALSE;
+ break;
+ case 'W':
+- if (strncasecmp(*buf, "Wed", 3) == 0)
++ if (strncasecmp(*buf, "Wed", abbrev_length) == 0)
+ *wday = 3;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Fri", 3) == 0)
++ if (strncasecmp(*buf, "Fri", abbrev_length) == 0)
+ *wday = 5;
+ else
+ return FALSE;
+@@ -77,8 +79,8 @@ scan_day_abbrev(const gchar **buf, gint *left, gint *wday)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+@@ -87,63 +89,65 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ {
+ *mon = -1;
+
+- if (*left < 3)
++ const gsize abbrev_length = 3;
++
++ if (*left < abbrev_length)
+ return FALSE;
+
+ switch (**buf)
+ {
+ case 'J':
+- if (strncasecmp(*buf, "Jan", 3) == 0)
++ if (strncasecmp(*buf, "Jan", abbrev_length) == 0)
+ *mon = 0;
+- else if (strncasecmp(*buf, "Jun", 3) == 0)
++ else if (strncasecmp(*buf, "Jun", abbrev_length) == 0)
+ *mon = 5;
+- else if (strncasecmp(*buf, "Jul", 3) == 0)
++ else if (strncasecmp(*buf, "Jul", abbrev_length) == 0)
+ *mon = 6;
+ else
+ return FALSE;
+ break;
+ case 'F':
+- if (strncasecmp(*buf, "Feb", 3) == 0)
++ if (strncasecmp(*buf, "Feb", abbrev_length) == 0)
+ *mon = 1;
+ else
+ return FALSE;
+ break;
+ case 'M':
+- if (strncasecmp(*buf, "Mar", 3) == 0)
++ if (strncasecmp(*buf, "Mar", abbrev_length) == 0)
+ *mon = 2;
+- else if (strncasecmp(*buf, "May", 3) == 0)
++ else if (strncasecmp(*buf, "May", abbrev_length) == 0)
+ *mon = 4;
+ else
+ return FALSE;
+ break;
+ case 'A':
+- if (strncasecmp(*buf, "Apr", 3) == 0)
++ if (strncasecmp(*buf, "Apr", abbrev_length) == 0)
+ *mon = 3;
+- else if (strncasecmp(*buf, "Aug", 3) == 0)
++ else if (strncasecmp(*buf, "Aug", abbrev_length) == 0)
+ *mon = 7;
+ else
+ return FALSE;
+ break;
+ case 'S':
+- if (strncasecmp(*buf, "Sep", 3) == 0)
++ if (strncasecmp(*buf, "Sep", abbrev_length) == 0)
+ *mon = 8;
+ else
+ return FALSE;
+ break;
+ case 'O':
+- if (strncasecmp(*buf, "Oct", 3) == 0)
++ if (strncasecmp(*buf, "Oct", abbrev_length) == 0)
+ *mon = 9;
+ else
+ return FALSE;
+ break;
+ case 'N':
+- if (strncasecmp(*buf, "Nov", 3) == 0)
++ if (strncasecmp(*buf, "Nov", abbrev_length) == 0)
+ *mon = 10;
+ else
+ return FALSE;
+ break;
+ case 'D':
+- if (strncasecmp(*buf, "Dec", 3) == 0)
++ if (strncasecmp(*buf, "Dec", abbrev_length) == 0)
+ *mon = 11;
+ else
+ return FALSE;
+@@ -152,8 +156,8 @@ scan_month_abbrev(const gchar **buf, gint *left, gint *mon)
+ return FALSE;
+ }
+
+- (*buf) += 3;
+- (*left) -= 3;
++ (*buf) += abbrev_length;
++ (*left) -= abbrev_length;
+ return TRUE;
+ }
+
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,84 @@
+From d4c8ba0c513052b5f19c6e989ba31f847f4900d1 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 14:30:22 +0200
+Subject: [PATCH 7/8] timeutils: fix invalid calculation of ISO timestamp
+ length
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 8 ++++++--
+ lib/timeutils/tests/test_scan-timestamp.c | 7 +++++++
+ 2 files changed, 13 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 197e3ad..4e618e4 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -346,19 +346,21 @@ __parse_usec(const guchar **data, gint *length)
+ static gboolean
+ __has_iso_timezone(const guchar *src, gint length)
+ {
+- return (length >= 5) &&
++ return (length >= 6) &&
+ (*src == '+' || *src == '-') &&
+ isdigit(*(src+1)) &&
+ isdigit(*(src+2)) &&
+ *(src+3) == ':' &&
+ isdigit(*(src+4)) &&
+ isdigit(*(src+5)) &&
+- !isdigit(*(src+6));
++ (length < 7 || !isdigit(*(src+6)));
+ }
+
+ static guint32
+ __parse_iso_timezone(const guchar **data, gint *length)
+ {
++ g_assert(*length >= 6);
++
+ gint hours, mins;
+ const guchar *src = *data;
+ guint32 tz = 0;
+@@ -368,8 +370,10 @@ __parse_iso_timezone(const guchar **data, gint *length)
+ hours = (*(src + 1) - '0') * 10 + *(src + 2) - '0';
+ mins = (*(src + 4) - '0') * 10 + *(src + 5) - '0';
+ tz = sign * (hours * 3600 + mins * 60);
++
+ src += 6;
+ (*length) -= 6;
++
+ *data = src;
+ return tz;
+ }
+diff --git a/lib/timeutils/tests/test_scan-timestamp.c b/lib/timeutils/tests/test_scan-timestamp.c
+index da375c8..9b38738 100644
+--- a/lib/timeutils/tests/test_scan-timestamp.c
++++ b/lib/timeutils/tests/test_scan-timestamp.c
+@@ -248,6 +248,13 @@ Test(parse_timestamp, non_zero_terminated_rfc5424_input_is_handled_properly)
+
+ }
+
++Test(parse_timestamp, non_zero_terminated_rfc5424_timestamp_only)
++{
++ const gchar *ts = "2022-08-17T05:02:28.417+03:00";
++ gint ts_len = strlen(ts);
++ _expect_rfc5424_timestamp_len_eq(ts, ts_len, ts);
++}
++
+
+ Test(parse_timestamp, daylight_saving_behavior_at_spring_with_explicit_timezones)
+ {
+--
+2.37.3
+
+
new file mode 100644
@@ -0,0 +1,47 @@
+From f60dcfa9e094dc9c2a752115ca426159c4ae4192 Mon Sep 17 00:00:00 2001
+From: Laszlo Varady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+Date: Sat, 20 Aug 2022 14:30:51 +0200
+Subject: [PATCH 8/8] timeutils: fix out-of-bounds reading of data buffer
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Signed-off-by: László Várady <laszlo.varady@protonmail.com><mailto:laszlo.varady@protonmail.com>
+
+Upstream-Status: Backport
+CVE: CVE-2022-38725
+
+Reference to upstream patch:
+https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d
+
+Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com><mailto:ovidiu.panait@windriver.com>
+---
+ lib/timeutils/scan-timestamp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/timeutils/scan-timestamp.c b/lib/timeutils/scan-timestamp.c
+index 4e618e4..0f7f52e 100644
+--- a/lib/timeutils/scan-timestamp.c
++++ b/lib/timeutils/scan-timestamp.c
+@@ -427,7 +427,7 @@ __parse_bsd_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ if (!scan_pix_timestamp((const gchar **) &src, &left, wct))
+ return FALSE;
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ src++;
+ left--;
+@@ -478,7 +478,7 @@ scan_rfc3164_timestamp(const guchar **data, gint *length, WallClockTime *wct)
+ * looking at you, skip that as well, so we can reliably detect IPv6
+ * addresses as hostnames, which would be using ":" as well. */
+
+- if (*src == ':')
++ if (left && *src == ':')
+ {
+ ++src;
+ --left;
+--
+2.37.3
+
+
@@ -22,6 +22,14 @@ SRC_URI = "https://github.com/balabit/syslog-ng/releases/download/${BP}/${BP}.ta
file://volatiles.03_syslog-ng \
file://syslog-ng-tmp.conf \
file://syslog-ng.service-the-syslog-ng-service.patch \
+ file://CVE-2022-38725-0001.patch \
+ file://CVE-2022-38725-0002.patch \
+ file://CVE-2022-38725-0003.patch \
+ file://CVE-2022-38725-0004.patch \
+ file://CVE-2022-38725-0005.patch \
+ file://CVE-2022-38725-0006.patch \
+ file://CVE-2022-38725-0007.patch \
+ file://CVE-2022-38725-0008.patch \
"
SRC_URI[sha256sum] = "90a25c9767fe749db50f118ddfc92ec71399763d2ecd5ad4f11ff5eea049e60b"
Fix buffer handling of syslog and timestamp parsers. References: https://nvd.nist.gov/vuln/detail/CVE-2022-38725 https://github.com/syslog-ng/syslog-ng/releases https://github.com/syslog-ng/syslog-ng/pull/4110 Upstream patches: https://github.com/syslog-ng/syslog-ng/commit/b5a060f2ebb8d794f508436a12e4d4163f94b1b8 https://github.com/syslog-ng/syslog-ng/commit/81a07263f1e522a376d3a30f96f51df3f2879f8a https://github.com/syslog-ng/syslog-ng/commit/4b8dc56ca8eaeac4c8751a305eb7eeefab8dc89d https://github.com/syslog-ng/syslog-ng/commit/73b5c300b8fde5e7a4824baa83a04931279abb37 https://github.com/syslog-ng/syslog-ng/commit/45f051239312e43bd4f92b9339fe67c6798a0321 https://github.com/syslog-ng/syslog-ng/commit/09f489c89c826293ff8cbd282cfc866ab56054c4 https://github.com/syslog-ng/syslog-ng/commit/8c6e2c1c41b0fcc5fbd464c35f4dac7102235396 https://github.com/syslog-ng/syslog-ng/commit/56f881c5eaa3d8c02c96607c4b9e4eaf959a044d Signed-off-by: Yogita Urade <yogita.urade@windriver.com> --- .../syslog-ng/files/CVE-2022-38725-0001.patch | 67 ++++++ .../syslog-ng/files/CVE-2022-38725-0002.patch | 152 +++++++++++++ .../syslog-ng/files/CVE-2022-38725-0003.patch | 79 +++++++ .../syslog-ng/files/CVE-2022-38725-0004.patch | 40 ++++ .../syslog-ng/files/CVE-2022-38725-0005.patch | 213 ++++++++++++++++++ .../syslog-ng/files/CVE-2022-38725-0006.patch | 182 +++++++++++++++ .../syslog-ng/files/CVE-2022-38725-0007.patch | 84 +++++++ .../syslog-ng/files/CVE-2022-38725-0008.patch | 47 ++++ .../syslog-ng/syslog-ng_3.36.1.bb | 8 + 9 files changed, 872 insertions(+) create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0001.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0002.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0003.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0004.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0005.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0006.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0007.patch create mode 100644 meta-oe/recipes-support/syslog-ng/files/CVE-2022-38725-0008.patch -- 2.34.1 Sent from Mail<https://go.microsoft.com/fwlink/?LinkId=550986> for Windows -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#99684): https://lists.openembedded.org/g/openembedded-devel/message/99684 Mute This Topic: https://lists.openembedded.org/mt/95194280/3616765 Group Owner: openembedded-devel+owner@lists.openembedded.org<mailto:openembedded-devel+owner@lists.openembedded.org> Unsubscribe: https://lists.openembedded.org/g/openembedded-devel/unsub [randy.macleod@windriver.com<mailto:randy.macleod@windriver.com>] -=-=-=-=-=-=-=-=-=-=-=- -- # Randy MacLeod # Wind River Linux