Merge pull request #4064 from citrus-it/rsyslogr54

rsyslog: Fix buffer overrun (r151054)

Author: hadfl

build/rsyslog/build.sh

@@ -12,12 +12,13 @@
 # http://www.illumos.org/license/CDDL.
 # }}}
 #
-# Copyright 2025 OmniOS Community Edition (OmniOSce) Association.
+# Copyright 2026 OmniOS Community Edition (OmniOSce) Association.
 
 . ../../lib/build.sh
 
 PROG=rsyslog
 VER=8.2502.0
+DASHREV=1
 PKG=system/rsyslog
 SUMMARY="rsyslog - the rocket-fast system for log processing."
 DESC="A high-performance, modular syslog implementation."

build/rsyslog/patches/series

@@ -2,4 +2,5 @@ runtime-parser.c.patch
 runtime-rsyslog.h.patch
 logonly.patch
 man.patch
+template.patch
 test.patch

build/rsyslog/patches/template.patch

@@ -0,0 +1,29 @@
+diff -wpruN --no-dereference '--exclude=*.orig' a~/template.c a/template.c
+--- a~/template.c	1970-01-01 00:00:00
++++ a/template.c	1970-01-01 00:00:00
+@@ -192,7 +192,13 @@ tplToString(struct template *__restrict__ const pTpl,
+ 	 */
+ 	pTpe = pTpl->pEntryRoot;
+ 	iBuf = 0;
+-	const int extra_space = (pTpl->optFormatEscape == JSONF) ? 1 : 3;
++	/*
++	 * We reserve one extra space for a trailing NUL. In the JSON case we
++	 * need to add space for an additional four characters, a potential
++	 * leading ", " if this is not the first value, and a trailing "}\n" if
++	 * it's the last.
++	 */
++	const int extra_space = (pTpl->optFormatEscape == JSONF) ? 1 : 5;
+ 	if(pTpl->optFormatEscape == JSONF) {
+ 		if(iparam->lenBuf < 2) /* we reserve one char for the final \0! */
+ 			CHKiRet(ExtendBuf(iparam, 2));
+@@ -228,8 +234,8 @@ tplToString(struct template *__restrict__ const pTpl,
+ 		/* got source, now copy over */
+ 		if(iLenVal > 0) { /* may be zero depending on property */
+ 			/* first, make sure buffer fits */
+-			if(iBuf + iLenVal + extra_space >= iparam->lenBuf) /* we reserve one char for the final \0! */
+-				CHKiRet(ExtendBuf(iparam, iBuf + iLenVal + 1));
++			if(iBuf + iLenVal + extra_space > iparam->lenBuf)
++				CHKiRet(ExtendBuf(iparam, iBuf + iLenVal + extra_space));
+ 
+ 			if(need_comma) {
+ 				memcpy(iparam->param + iBuf, ", ", 2);