[PATCH] klogd busy loop on zero byte (output from 3c59x driver)

[Troels Walsted Hansen]

Hi all.

I found a bug in the sysklogd package version 1.4. When it encounters a zero
byte in the kernel logging output, the text parser enters a busy loop. I
came upon it when the 3c59x driver from kernel 2.4.0 started outputting two
zero bytes for the product code of my laptop's 3Com card. It could be argued
that the kernel should never output zero bytes in the logging info, but
obviously that will happen from time to time.

I fear this bug might be considered a security issue as well, if the kernel
can be coerced to output a zero byte somehow, all kernel logging will stop.

I have included a patch to klogd.c to correct the issue.

--- sysklogd-1.4.orig/klogd.c	Mon Sep 18 09:34:11 2000
+++ sysklogd-1.4/klogd.c	Thu Jan 11 09:26:10 2001
@@ -739,6 +758,13 @@
 		  break;  /* full line_buff or end of input buffer */
                }

+               if( *ptr == '\0' ) /* zero byte */
+               {
+                  ptr++;	/* skip zero byte */
+                  space -= 1;
+                  len   -= 1;
+                  break;
+               }
                if( *ptr == '\n' )  /* newline */
                {
                   ptr++;	/* skip newline */

--
Troels Walsted Hansen
[e-mail]