Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pack-gelf: fix OSS-Fuzz issue 5076752961110016 #3100

Merged
merged 1 commit into from
Feb 22, 2021
Merged

pack-gelf: fix OSS-Fuzz issue 5076752961110016 #3100

merged 1 commit into from
Feb 22, 2021

Conversation

DavidKorczynski
Copy link
Contributor

Signed-off-by: davkor david@adalogics.com

This solves an issue in parsing an msgpack-c object related to gelf data. The main problem is that a wrong variable is used to get the msgpack data, and this results in various bugs, amongst other things a heap overflow in flb_msgpack_gelf_value_ext (OSS-Fuzz issue 5076752961110016)

@edsiper please verify this one, i.e. that we need to use v instead of o. v is the variable used all other places for getting the val and val_len variables.


Enter [N/A] in the box, if an item is not applicable to your change.

Testing
Before we can approve your change; please submit the following in a comment:

  • [N/A] Example configuration file for the change
  • [N/A] Debug log output from testing the change
  • [N/A] Attached Valgrind output that shows no leaks or memory corruption was found

Documentation

  • [N/A] Documentation required for this feature

Fluent Bit is licensed under Apache 2.0, by submitting this pull request I understand that this code will be released under the terms of that license.

Signed-off-by: davkor <david@adalogics.com>
@DavidKorczynski DavidKorczynski changed the title flb_pack: fix OSS-Fuzz issue 5076752961110016 pack-gelf: fix OSS-Fuzz issue 5076752961110016 Feb 22, 2021
@edsiper edsiper merged commit 9a3bd47 into fluent:master Feb 22, 2021
@edsiper
Copy link
Member

edsiper commented Feb 22, 2021

thanks

DrewZhang13 pushed a commit to DrewZhang13/fluent-bit that referenced this pull request May 3, 2021
Signed-off-by: davkor <david@adalogics.com>
DrewZhang13 pushed a commit to DrewZhang13/fluent-bit that referenced this pull request May 3, 2021
Signed-off-by: davkor <david@adalogics.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants