Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

logproto: fix invalid buffer handling when encoding() is used #3892

Merged
merged 12 commits into from
Feb 3, 2022

Conversation

MrAnno
Copy link
Collaborator

@MrAnno MrAnno commented Jan 27, 2022

log_proto_text_server_split_buffer() moves data within self->data for which we maintain additional pointers: buffer_start.

This pointer needs to be updated after the memmove() call, otherwise it could point to partially overwritten data in case the memmove() operation overlaps.

A few lines below my fix, buffer_start is passed to a decoder function called log_proto_text_server_get_raw_size_of_buffer(), which could fail and report incorrect positions.

This could result in message duplication, partial message loss, but it only occurs when non-fixed length or less known fixed-length encodings are used (encodings that are not listed in fixed_encodings).

@kira-syslogng
Copy link
Contributor

Build SUCCESS

@MrAnno
Copy link
Collaborator Author

MrAnno commented Jan 27, 2022

@kira-syslogng do stresstest

@kira-syslogng
Copy link
Contributor

Build SUCCESS

@kira-syslogng
Copy link
Contributor

Kira-stress-test: Build SUCCESS

@MrAnno
Copy link
Collaborator Author

MrAnno commented Jan 28, 2022

@Kokan I need to validate my theory, but this might be one of the root causes of the Big5 encoding issue that we've discussed IRL.

news/bugfix-3892.md Outdated Show resolved Hide resolved
Copy link
Collaborator

@bazsi bazsi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The bug itself is a good catch, must have been very difficult to reproduce and fix it. However I don't think we need to change the argument list of fetch_from_buffer().

@MrAnno
Copy link
Collaborator Author

MrAnno commented Jan 29, 2022

@kira-syslogng do stresstest

@kira-syslogng
Copy link
Contributor

Build SUCCESS

@kira-syslogng
Copy link
Contributor

Kira-stress-test: Build SUCCESS

Signed-off-by: László Várady <laszlo.varady@protonmail.com>
@MrAnno MrAnno force-pushed the fix-file-enc-buf-split branch 2 times, most recently from 1c36b11 to cd59631 Compare January 30, 2022 17:08
@kira-syslogng
Copy link
Contributor

Build FAILURE

@kira-syslogng
Copy link
Contributor

Build SUCCESS

@MrAnno MrAnno force-pushed the fix-file-enc-buf-split branch 2 times, most recently from 7115c34 to f9d1081 Compare January 30, 2022 18:40
@syslog-ng syslog-ng deleted a comment from kira-syslogng Jan 30, 2022
@syslog-ng syslog-ng deleted a comment from kira-syslogng Jan 30, 2022
@MrAnno
Copy link
Collaborator Author

MrAnno commented Jan 30, 2022

@kira-syslogng do stresstest

@kira-syslogng
Copy link
Contributor

Build SUCCESS

@kira-syslogng
Copy link
Contributor

Kira-stress-test: Build SUCCESS

bazsi
bazsi previously approved these changes Jan 31, 2022
Kokan
Kokan previously approved these changes Jan 31, 2022
@MrAnno
Copy link
Collaborator Author

MrAnno commented Jan 31, 2022

We're running some additional tests before merge.

This test reproduces a bug in log_proto_text_server_split_buffer(), where
an invalid (partially overwritten) buffer slice is passed to our decoder
function (log_proto_text_server_get_raw_size_of_buffer()).

The subsequent commit fixes this bug.

Signed-off-by: László Várady <laszlo.varady@protonmail.com>
log_proto_text_server_split_buffer() moves data within self->data for which
we maintain additional pointers: buffer_start.

This pointer needs to be updated after the memmove() call, otherwise it
could point to partially overwritten data in case the memmove() operation
overlaps.

A few lines below, buffer_start is passed to a decoder function called
log_proto_text_server_get_raw_size_of_buffer(), which could fail and report
incorrect positions for file sources.

This could result in message duplication, partial message loss,
but it only occurs when non-fixed length or less known
fixed-length encodings are used (encodings that are not listed in
fixed_encodings).

Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
split_buffer() moves data from the middle/end of the buffer to the
beginning, which is the responsibility of LogProtoBufferedServer.

Currently, the split logic is not called when the end of the buffer is
reached, it is called on specific LogProtoTextServer events, so the method
is currently "protected" instead of "private".

Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
Signed-off-by: László Várady <laszlo.varady@protonmail.com>
@MrAnno MrAnno dismissed stale reviews from Kokan and bazsi via 46bfe6c February 1, 2022 17:17
@kira-syslogng
Copy link
Contributor

Build SUCCESS

@MrAnno MrAnno added this to the syslog-ng-3.36 milestone Feb 3, 2022
@bazsi bazsi merged commit 8cd7af7 into syslog-ng:master Feb 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants