potential segfault when using mmnormalize #717

rgerhards opened this Issue Dec 23, 2015 · 1 comment


None yet

1 participant


When compiled with json-c, rsyslog can potentially abort under these conditions:

  • mmnormalize is used
  • a rule has normalization tags assigned
  • an action involving the "$!tags.event" property is executed asynchronously

The root cause is a problem is a thread-unsafety bug in json-c (see json-c/json-c#212), which causes invalid refcouting and thus premature destruction of the (conceptionally read-only) tags.events json object. There is no simple workaround for liblognorm and rsyslog to solve this situation. The likelihood of segfault increases with increasing traffic. It is highly unlikely that this problem occurs under low traffic conditions, but theoretically possible.

For those who build themselves: there has a fix been posted on the json-c project (json-c/json-c#211) but this fix has not been accepted upstream. You may want to apply it in order to resolve the issue.

For rsyslog, the solution is to switch to libfastjson instead. Support for building with it has already been added in 8.15.0. There are various reasons for the switch. Please check http://blog.gerhards.net/2015/12/rsyslog-and-liblognorm-will-switch-to.html
for the full reasoning.

@rgerhards rgerhards added this to the v8.16 release milestone Dec 23, 2015

Solved in 8.16.0 if libfastson is used. However, we do not yet require libfastjson to ease migration. That will change with 8.17.0.

@rgerhards rgerhards closed this in #772 Feb 3, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment