[icinga-checkins] icinga.org: icinga-core/test/cgis: classic-ui: segfault when reading malformed log entries #3528

[git at icinga.org]

Module: icinga-core
Branch: test/cgis
Commit: a82acf9379bbd51b0f8b6ce937e476d623650557
URL:    https://git.icinga.org/?p=icinga-core.git;a=commit;h=a82acf9379bbd51b0f8b6ce937e476d623650557

Author: Ricardo Bartels <ricardo at bitchbrothers.com>
Date:   Tue Jan 22 20:53:45 2013 +0100

classic-ui: segfault when reading malformed log entries #3528

refs: #3528

now we check if temp_buffer is actually filled before we pass it
on to strstr.

---

 Changelog      |    1 +
 cgi/readlogs.c |    9 ++++++++-
 2 files changed, 9 insertions(+), 1 deletions(-)

diff --git a/Changelog b/Changelog
index 49b5a86..12696d6 100644
--- a/Changelog
+++ b/Changelog
@@ -57,6 +57,7 @@ FIXES
 * classic ui: fixed extinfo.cgi shows localtime(0) instead of "NOT SET" when global notifications are not set to expire #3482 - RB
 * classic ui: fixed CGIs generating invalid html code/ json when throwing error #3507 - RB
 * classic ui: fixed JSON output is insufficiently escaped #3541 - RB
+* classic ui: fixed segfault when reading malformed log entries #3528 - RB
 
 * docs: add missing cmd_mod description in cgi params #3438 - MF
 * docs: search_string as cgi GET param works also for status.cgi #3451 - MF
diff --git a/cgi/readlogs.c b/cgi/readlogs.c
index 3c3d87a..90867e3 100644
--- a/cgi/readlogs.c
+++ b/cgi/readlogs.c
@@ -382,7 +382,11 @@ int get_log_entries(logentry **entry_list, logfilter **filter_list, char **error
 
 			/* get timestamp */
 			temp_buffer = strtok(input, "]");
-			timestamp = (temp_buffer == NULL) ? 0L : strtoul(temp_buffer + 1, NULL, 10);
+
+			if (temp_buffer == NULL)
+				continue;
+
+			timestamp = strtoul(temp_buffer + 1, NULL, 10);
 
 			/* skip line if out of range */
 			if ((ts_end >= 0 && timestamp > ts_end) || (ts_start >= 0 && timestamp < ts_start))
@@ -391,6 +395,9 @@ int get_log_entries(logentry **entry_list, logfilter **filter_list, char **error
 			/* get log entry text */
 			temp_buffer = strtok(NULL, "\n");
 
+			if (temp_buffer == NULL)
+				continue;
+
 			/* if we search for something, check if it entry matches search_string */
 			if (search_string != NULL) {
 				if (regexec(&preg, temp_buffer, 0, NULL, 0) == REG_NOMATCH)