From 324d6aa92629d4368b517f5c4d17a103c69098be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
Date: Sun, 20 May 2018 22:06:23 +0200
Subject: [PATCH] shared/logs-show: fix mixup between length-based memory
 duplication and string operations

We'd look for a '=' separator using memchr, i.e. ignoring any nul bytes in the
string, but then do a strndup, which would terminate on any nul byte, and then
again do a memcmp, which would access memory past the chunk allocated by strndup.

Of course, we probably shouldn't allow keys with nul bytes in them. But we
currently do, so there might be journal files like that out there. So let's fix
the journal-reading code first.
---
 src/shared/logs-show.c                           |   4 ++--
 ...rash-96dee870ea66d03e89ac321eee28ea63a9b9aa45 | Bin 0 -> 2490 bytes
 2 files changed, 2 insertions(+), 2 deletions(-)
 create mode 100644 test/fuzz-regressions/fuzz-journal-remote/crash-96dee870ea66d03e89ac321eee28ea63a9b9aa45

diff --git a/src/shared/logs-show.c b/src/shared/logs-show.c
index 50326fde5d..124fa838b3 100644
--- a/src/shared/logs-show.c
+++ b/src/shared/logs-show.c
@@ -839,7 +839,7 @@ static int output_json(
                 if (!eq)
                         continue;
 
-                n = strndup(data, eq - (const char*) data);
+                n = memdup_suffix0(data, eq - (const char*) data);
                 if (!n) {
                         r = log_oom();
                         goto finish;
@@ -891,7 +891,7 @@ static int output_json(
 
                         m = eq - (const char*) data;
 
-                        n = strndup(data, m);
+                        n = memdup_suffix0(data, m);
                         if (!n) {
                                 r = log_oom();
                                 goto finish;
diff --git a/test/fuzz-regressions/fuzz-journal-remote/crash-96dee870ea66d03e89ac321eee28ea63a9b9aa45 b/test/fuzz-regressions/fuzz-journal-remote/crash-96dee870ea66d03e89ac321eee28ea63a9b9aa45
new file mode 100644
index 0000000000000000000000000000000000000000..535d49ea7a01a37782964e4edf2b7ddee59a6e3c
GIT binary patch
literal 2490
zcmeHJO>fjN5asL>KY;@hDiT^xVmr20MoqVA8_`XcB#TrOh~j)updX0sVOxGYymX7y
z3#BV<D-KwR<BTU0XXg36RMljj<!NRYR%zuofu}s;PDsUFz=hV@w7PC<*~sx{>vzVd
zv9rApN(U5>lw9yYxE{Wy>v=%BuZ=%GwPdv7z9X*<#urxfEtd_esw@f*i+CDULzfrf
zbY@9#L7Z?%PCD@6HBEcJFPEk(mwjW)Wn*wsx#T@8PQYqZxoqVX%>7$*4ra^`Q=QNl
z_;?x-$gyf3?^@2P{ncd}P7dNEs&J<adDPT`TJjol%G7~ToC48!fm5Veb&%#o5>6v~
ze7?9it4}+YALWPXel^46o(w!<w}*K;&nD5`-zc;%NwM9q2rb`mV@TbDms77-PH|n%
zBrVb;p4_f_Abq0<#W&Jp)lQlgLrwmMELIg+nB=oGE9~NOadQ5N&9XSn;^N5qEPwiB
z)h6-bU{Sy874Jq#5%0xOW=Hcp8|6E3GMZ#*!hpg&+>h)Dz)}NP;^PWRG@#6Fm*2}}
z4P+6{w&s8r|KLv-&&y@d^8teZWD9h1?{Yxpc6kOD0Fc991B3%IJHCak1tRs!*Q;=i
zcQp9L8I1CHWpi*PgmhR&*S=Z3vv0m2*!5a)g@<ul-!L_-q&dI<ARo-y{D8&1z#UdZ
zcv+1wjeCzN#O(N2Ky|&H@W<W#zXp$1gGXVb;6d1kZrJGO=Gw#Rlv$71<UNQDTDBo#
zTglE|xIVE>uijN46>!9$pd>&T8hk<$d?iaR9z`^oo7{T$`v-vZ;ve8{(NO<DZlMkr
f&maK(tAVmHKvD-qsA+^w7DzK#xZS+e8^(SC$AjjK

literal 0
HcmV?d00001