Preserve remaining bytes in the log server read callback functions.

We were not properly handling the case where there were a few bytes
left over after processing the message(s).  Previously, we would
reset the length without moving the remaining bytes to the head of
the buffer.  This could result in a corrupted message.

Thanks to Joshua Rogers for finding this.

Author: millert

logsrvd/logsrvd.c

@@ -1149,6 +1149,9 @@ client_msg_cb(int fd, int what, void *v)
 	}
 	buf->off += msg_len;
     }
+    if (buf->len != buf->off) {
+	memmove(buf->data, buf->data + buf->off, buf->len - buf->off);
+    }
     buf->len -= buf->off;
     buf->off = 0;
 

logsrvd/logsrvd_relay.c

@@ -1,7 +1,7 @@
 /*
  * SPDX-License-Identifier: ISC
  *
- * Copyright (c) 2019-2022 Todd C. Miller <[email protected]>
+ * Copyright (c) 2019-2023, 2025 Todd C. Miller <[email protected]>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -897,6 +897,9 @@ relay_server_msg_cb(int fd, int what, void *v)
 	    goto send_error;
 	buf->off += msg_len;
     }
+    if (buf->len != buf->off) {
+	memmove(buf->data, buf->data + buf->off, buf->len - buf->off);
+    }
     buf->len -= buf->off;
     buf->off = 0;
     debug_return;

logsrvd/sendlog.c

@@ -1,7 +1,7 @@
 /*
  * SPDX-License-Identifier: ISC
  *
- * Copyright (c) 2019-2023 Todd C. Miller <[email protected]>
+ * Copyright (c) 2019-2023, 2025 Todd C. Miller <[email protected]>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -1428,6 +1428,9 @@ server_msg_cb(int fd, int what, void *v)
 	    goto bad;
 	buf->off += msg_len;
     }
+    if (buf->len != buf->off) {
+	memmove(buf->data, buf->data + buf->off, buf->len - buf->off);
+    }
     buf->len -= buf->off;
     buf->off = 0;
     debug_return;

plugins/sudoers/log_client.c

@@ -1856,6 +1856,9 @@ server_msg_cb(int fd, int what, void *v)
 	    goto bad;
 	buf->off += msg_len;
     }
+    if (buf->len != buf->off) {
+	memmove(buf->data, buf->data + buf->off, buf->len - buf->off);
+    }
     buf->len -= buf->off;
     buf->off = 0;
     debug_return;