Fix for use after free in affile_dw_reap

This resolves rhbz#1663936.
This commit is contained in:
My Karlsson 2019-01-07 21:30:05 +01:00
parent bbd91c3e94
commit 9d7a20353e
2 changed files with 36 additions and 1 deletions

View File

@ -0,0 +1,29 @@
diff -ur syslog-ng-3.17.2.orig/modules/affile/affile-dest.c syslog-ng-3.17.2/modules/affile/affile-dest.c
--- syslog-ng-3.17.2.orig/modules/affile/affile-dest.c 2018-06-18 17:06:54.000000000 +0200
+++ syslog-ng-3.17.2/modules/affile/affile-dest.c 2019-01-07 20:56:31.666768932 +0100
@@ -127,21 +127,22 @@
affile_dw_reap(gpointer s)
{
AFFileDestWriter *self = (AFFileDestWriter *) s;
+ AFFileDestDriver *owner = self->owner;
main_loop_assert_main_thread();
- g_static_mutex_lock(&self->owner->lock);
+ g_static_mutex_lock(&owner->lock);
if (!log_writer_has_pending_writes((LogWriter *) self->writer) && !self->queue_pending)
{
msg_verbose("Destination timed out, reaping",
evt_tag_str("template", self->owner->filename_template->template),
evt_tag_str("filename", self->filename));
affile_dd_reap_writer(self->owner, self);
- g_static_mutex_unlock(&self->owner->lock);
+ g_static_mutex_unlock(&owner->lock);
}
else
{
- g_static_mutex_unlock(&self->owner->lock);
+ g_static_mutex_unlock(&owner->lock);
affile_dw_arm_reaper(self);
}
}

View File

@ -8,7 +8,7 @@
Name: syslog-ng
Version: %{syslog_ng_ver}
Release: 1%{?dist}
Release: 2%{?dist}
Summary: Next-generation syslog server
Group: System Environment/Daemons
@ -19,6 +19,9 @@ Source1: syslog-ng.conf
Source2: syslog-ng.logrotate
Source3: syslog-ng.service
# https://github.com/balabit/syslog-ng/issues/2454
Patch1: syslog-ng-3.17.2-1663936-use-after-free.patch
BuildRequires: perl-generators
BuildRequires: systemd-units
BuildRequires: pkgconfig
@ -429,6 +432,9 @@ fi
%changelog
* Mon Jan 07 2019 My Karlsson <mk@acc.umu.se> - 3.17.2-2
- Backport fix for use after free in affile_dw_reap (rhbz#1663936)
* Sat Aug 11 2018 My Karlsson <mk@acc.umu.se> - 3.17.2-1
- Update to version 3.17.2 (rhbz#1614997)