summaryrefslogtreecommitdiff
path: root/src/journal
diff options
context:
space:
mode:
authorZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2014-08-26 23:54:31 -0400
committerZbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>2014-08-27 21:05:28 -0400
commit0f99f74a14ef193c1ebde687c5cc76e1d67b85ef (patch)
tree41d8d75a5ef374a15a7bf3d26dd4da12476f09af /src/journal
parent57cd09acf2c63a414aa2131c00a2b3f600eb0133 (diff)
sd-journal: verify that object start with the field name
If the journal is corrupted, we might return an object that does not start with the expected field name and/or is shorter than it should.
Diffstat (limited to 'src/journal')
-rw-r--r--src/journal/journal-file.c1
-rw-r--r--src/journal/sd-journal.c15
2 files changed, 15 insertions, 1 deletions
diff --git a/src/journal/journal-file.c b/src/journal/journal-file.c
index 986e94de39..7286e14ddb 100644
--- a/src/journal/journal-file.c
+++ b/src/journal/journal-file.c
@@ -425,7 +425,6 @@ int journal_file_move_to_object(JournalFile *f, int type, uint64_t offset, Objec
if (!VALID64(offset))
return -EFAULT;
-
r = journal_file_move_to(f, type_to_context(type), false, offset, sizeof(ObjectHeader), &t);
if (r < 0)
return r;
diff --git a/src/journal/sd-journal.c b/src/journal/sd-journal.c
index 80ff8fef57..693707cb34 100644
--- a/src/journal/sd-journal.c
+++ b/src/journal/sd-journal.c
@@ -2571,6 +2571,21 @@ _public_ int sd_journal_enumerate_unique(sd_journal *j, const void **data, size_
if (r < 0)
return r;
+ /* Check if we have at least the field name and "=". */
+ if (ol <= k) {
+ log_debug("%s:offset " OFSfmt ": object has size %zu, expected at least %zu",
+ j->unique_file->path, j->unique_offset,
+ ol, k + 1);
+ return -EBADMSG;
+ }
+
+ if (memcmp(odata, j->unique_field, k) || ((const char*) odata)[k] != '=') {
+ log_debug("%s:offset " OFSfmt ": object does not start with \"%s=\"",
+ j->unique_file->path, j->unique_offset,
+ j->unique_field);
+ return -EBADMSG;
+ }
+
/* OK, now let's see if we already returned this data
* object by checking if it exists in the earlier
* traversed files. */