On Sat, Jan 29, 2022 at 08:59:39PM +0100, Florian Ernst wrote: > [...] > | Version 0.1.11 2018-10-30 > [...] > | - bugfix: es_str2num mishandling empty strings > | If es_str2num() receives an empty string, misadressing happens. > | Under extreme conditions, this theoretically can lead to a segfault. > | Thanks to Jan Gerhards for the patch. > | closes https://github.com/rsyslog/libestr/issues/10 > [...]
FWIW, this is the relevant part of this bugfix:
| diff -Nru libestr-0.1.10/src/string.c libestr-0.1.11/src/string.c
| --- libestr-0.1.10/src/string.c 2014-12-09 11:32:32.000000000 +0100
| +++ libestr-0.1.11/src/string.c 2018-10-18 18:38:39.000000000 +0200
| @@ -607,10 +607,10 @@
| {
| long long num;
| unsigned char *c;
| -
| if(s->lenStr == 0) {
| num = 0;
| - *bSuccess = 0;
| + if(bSuccess != NULL)
| + *bSuccess = 0;
| goto done;
| }
|
And I can confirm that when you apply the current packaging to upstream
0.1.11 it still manages to build its packages (albeit not entirely
lintian clean).
Cheers,
Flo
signature.asc
Description: PGP signature
