{"action":"created","issue":{"url":"https://api.github.com/repos/rsyslog/liblognorm/issues/66","labels_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/66/labels{/name}","comments_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/66/comments","events_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/66/events","html_url":"https://github.com/rsyslog/liblognorm/issues/66","id":83700428,"number":66,"title":"Segfault on literal characters","user":{"login":"ontholerian","id":8070781,"avatar_url":"https://avatars.githubusercontent.com/u/8070781?v=3","gravatar_id":"","url":"https://api.github.com/users/ontholerian","html_url":"https://github.com/ontholerian","followers_url":"https://api.github.com/users/ontholerian/followers","following_url":"https://api.github.com/users/ontholerian/following{/other_user}","gists_url":"https://api.github.com/users/ontholerian/gists{/gist_id}","starred_url":"https://api.github.com/users/ontholerian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ontholerian/subscriptions","organizations_url":"https://api.github.com/users/ontholerian/orgs","repos_url":"https://api.github.com/users/ontholerian/repos","events_url":"https://api.github.com/users/ontholerian/events{/privacy}","received_events_url":"https://api.github.com/users/ontholerian/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-06-01T21:24:57Z","updated_at":"2015-06-10T06:26:33Z","closed_at":null,"body":"If a logfile happens to have certain characters at the start of a parser, it can cause liblognorm to segfault.\r\n\r\nExample that demonstrates the issue:\r\n``$ cat example.rb``\r\nrule=:%foo:word% %bar:number% %baz:word%\r\n``$ echo -e \"a 2 c\" | lognormalizer -r example.rb -e json``\r\n{ \"baz\": \"c\", \"bar\": \"2\", \"foo\": \"a\" }\r\n``$ echo -e \"a \\xf9 c\" | lognormalizer -r example.rb -e json``\r\nSegmentation fault (core dumped)\r\n\r\nAfter digging through the code, looks like its caused by an improper casting of a signed char to an integer, where an unsigned char is expected. All of the code is in ``ptree.c`` and regards how the use of  ``ln_ptree->subtree`` is index-referenced. Note that in ``ln_buildPTree``, the variable used to index ``tree->subtree`` is ``c``, which is an ``unsigned char *``. However, in ``ln_normalizeRec`` where it checks if the next parser should be a literal, it casts a value from ``str`` -- a ``const char *`` -- to ``int``.\r\n\r\nA char of ``\\xf9`` casts to value 249 as an unsigned char and to value -7 as an integer, so the casting will take you to two different indexes in the ``tree->subtree`` array, and one of those has a very undesirable result."},"comment":{"url":"https://api.github.com/repos/rsyslog/liblognorm/issues/comments/110612320","html_url":"https://github.com/rsyslog/liblognorm/issues/66#issuecomment-110612320","issue_url":"https://api.github.com/repos/rsyslog/liblognorm/issues/66","id":110612320,"user":{"login":"janmejay","id":12777,"avatar_url":"https://avatars.githubusercontent.com/u/12777?v=3","gravatar_id":"","url":"https://api.github.com/users/janmejay","html_url":"https://github.com/janmejay","followers_url":"https://api.github.com/users/janmejay/followers","following_url":"https://api.github.com/users/janmejay/following{/other_user}","gists_url":"https://api.github.com/users/janmejay/gists{/gist_id}","starred_url":"https://api.github.com/users/janmejay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/janmejay/subscriptions","organizations_url":"https://api.github.com/users/janmejay/orgs","repos_url":"https://api.github.com/users/janmejay/repos","events_url":"https://api.github.com/users/janmejay/events{/privacy}","received_events_url":"https://api.github.com/users/janmejay/received_events","type":"User","site_admin":false},"created_at":"2015-06-10T06:26:33Z","updated_at":"2015-06-10T06:26:33Z","body":"Can you please add a test to cover the bug?\n\n--\nRegards,\nJanmejay\n\nPS: Please blame the typos in this mail on my phone's uncivilized soft\nkeyboard sporting it's not-so-smart-assist technology.\n\nOn Jun 10, 2015 6:37 AM, \"ontholerian\" <notifications@github.com> wrote:\n\n> See pull request #67 <https://github.com/rsyslog/liblognorm/pull/67>\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/rsyslog/liblognorm/issues/66#issuecomment-110550085>.\n>\n"}}