mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2024-11-26 07:55:01 +00:00
Code Issues Releases Activity

When parsing a rule to rotate log files on a specific week day,

Browse Source 
parseDWM() can advance the time to the next week. If the next week is
in the next month, then tm_mon is incremented. However, the increment
was failing to handle the wraparound from December to January, so when
parsing a rule during the last week of the December, the month would
advance to month 12. This triggered an out-of-bounds read of the
mtab[] array in days_pmonth() after parseDWM() returned.  To fix,
this change resets the month to January and increment the year when
the month increment wraps.

The default rule for /var/log/weekly.log triggers this during the
last week of December each year.
Reported by:	CHERI
Obtained from:	CheriBSD
Reviewed by:	jhb
Sponsored by:	The University of Cambridge, Google Inc.
Differential Revision:	<https://reviews.freebsd.org/D33687>
This commit is contained in:
Garance A Drosehn 2021-12-30 20:45:13 +00:00
parent 5e6a2d6eb2
commit b7b447fd4c
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
usr.sbin/newsyslog/ptimes.c
View File

@ -279,6 +279,10 @@ parseDWM(struct ptime_data *ptime, const char *s)
if (tm.tm_mday > daysmon) {
tm.tm_mon++;
tm.tm_mday = tm.tm_mday - daysmon;
if (tm.tm_mon >= 12) {
tm.tm_mon = 0;
tm.tm_year++;
}
}
}
break;