* [PATCH] Fix error handing when searching for an interpreted value
@ 2008-01-31 9:02 Miloslav Trmac
2008-01-31 15:03 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Miloslav Trmac @ 2008-01-31 9:02 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1: Type: text/plain, Size: 228 bytes --]
Hello,
auparse would crash if there was an interpreted filter item defined and
the field could not be interpreted (e.g. it had an invalid format).
The attached patch modifies auparse to use the raw value in such cases.
Mirek
[-- Attachment #2: audit-1.6.6-auparse-crash.patch --]
[-- Type: text/x-patch, Size: 518 bytes --]
diff -ur audit/auparse/auparse.c audit-1.6.6/auparse/auparse.c
--- audit/auparse/auparse.c 2007-11-19 19:44:04.000000000 +0100
+++ audit-1.6.6/auparse/auparse.c 2008-01-31 09:41:02.000000000 +0100
@@ -899,9 +899,10 @@
if (search_op == AUSEARCH_EXISTS)
return 1;
+ val = NULL;
if ((rule->search_op & AUSEARCH_INTERPRETED) != 0)
val = nvlist_interp_cur_val(r);
- else
+ if (val == NULL)
val = nvlist_get_cur_val(&r->nv);
rc = strcmp(rule->v.field.val, val);
if (search_op == AUSEARCH_EQUAL)
[-- Attachment #3: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-01-31 15:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-01-31 9:02 [PATCH] Fix error handing when searching for an interpreted value Miloslav Trmac
2008-01-31 15:03 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.