Re: [userspace PATCH] Prevent free() of stack buffer with NOLOG format

[Steve Grubb <sgrubb@redhat.com>]

On Monday, December 5, 2016 6:01:02 PM EST George McCollister wrote:
> When the NOLOG format is used replace_event_msg() doesn't change
> e->reply.message so the message located on the stack is left and later is
> free()'d in cleanup_event() resulting in the following:

Hmm...thanks for reporting this. Which version of audit are you using?

Steve

> *** Error in `auditd': free(): invalid pointer: 0x800bef7c ***
> ======= Backtrace: =========
> /lib/libc.so.6(+0x676ba)[0xb752b6ba]
> /lib/libc.so.6(+0x6e227)[0xb7532227]
> /lib/libc.so.6(+0x6e9e6)[0xb75329e6]
> auditd(+0x73df)[0x800a43df]
> auditd(+0x4975)[0x800a1975]
> auditd(+0x4a9c)[0x800a1a9c]
> auditd(main+0x931)[0x800a0c21]
> /lib/libc.so.6(__libc_start_main+0xf6)[0xb74dc1a6]
> auditd(+0x44c4)[0x800a14c4]
> ======= Memory map: ========
> ...
> 
> This patch changes the log format to RAW when NOLOG format is detected
> so that replace_event_msg() will replace e->reply.message with a message
> that can be free()'d by cleanup_event().
> 
> Signed-off-by: George McCollister <george.mccollister@gmail.com>
> ---
>  src/auditd-config.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/src/auditd-config.c b/src/auditd-config.c
> index 584f079..bc06b1c 100644
> --- a/src/auditd-config.c
> +++ b/src/auditd-config.c
> @@ -839,6 +839,7 @@ static int log_format_parser(struct nv_pair *nv, int
> line, if (strcasecmp(nv->value, log_formats[i].name) == 0) {
>  			config->log_format = log_formats[i].option;
>  			if (config->log_format == LF_NOLOG) {
> +				config->log_format = LF_RAW;
>  				audit_msg(LOG_WARNING,
>  				    "The NOLOG option to log_format is deprecated. Please use 
the
> write_logs option."); if (config->write_logs != 0)