From: Daan De Meyer <daan.j.demeyer@gmail.com>
Date: Wed, 26 Apr 2023 11:21:55 +0000 (+0200)
Subject: journal: Don't try to write garbage if journal entry is corrupted
X-Git-Tag: v254-rc1~623^2~3
X-Git-Url: http://git-history.diyao.me/?a=commitdiff_plain;h=f81409f844ae8077f7ee7664871f73fa7d440581;p=systemd%2F.git

journal: Don't try to write garbage if journal entry is corrupted

If journal_file_data_payload() returns -EBADMSG or -EADDRNOTAVAIL,
we skip the entry and go to the next entry, but we never modify
the number of items that we pass to journal_file_append_entry_internal()
if that happens, which means we could try to append garbage to the
journal file.

Let's keep track of the number of fields we've appended to avoid this
problem.
---

diff --git a/src/libsystemd/sd-journal/journal-file.c b/src/libsystemd/sd-journal/journal-file.c
index 3753e29d0d..bafd2bae80 100644
--- a/src/libsystemd/sd-journal/journal-file.c
+++ b/src/libsystemd/sd-journal/journal-file.c
@@ -4168,7 +4168,7 @@ int journal_file_copy_entry(
 
         _cleanup_free_ EntryItem *items_alloc = NULL;
         EntryItem *items;
-        uint64_t q, n, xor_hash = 0;
+        uint64_t q, n, m = 0, xor_hash = 0;
         const sd_id128_t *boot_id;
         dual_timestamp ts;
         int r;
@@ -4227,7 +4227,7 @@ int journal_file_copy_entry(
                 else
                         xor_hash ^= le64toh(u->data.hash);
 
-                items[i] = (EntryItem) {
+                items[m++] = (EntryItem) {
                         .object_offset = h,
                         .hash = le64toh(u->data.hash),
                 };
@@ -4240,6 +4240,9 @@ int journal_file_copy_entry(
                         return r;
         }
 
+        if (m == 0)
+                return 0;
+
         r = journal_file_append_entry_internal(
                         to,
                         &ts,
@@ -4247,7 +4250,7 @@ int journal_file_copy_entry(
                         &from->header->machine_id,
                         xor_hash,
                         items,
-                        n,
+                        m,
                         seqnum,
                         seqnum_id,
                         /* ret_object= */ NULL,