* [PATCH] Fix error handing when searching for an interpreted value
@ 2008-01-31 9:02 Miloslav Trmac
2008-01-31 15:03 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Miloslav Trmac @ 2008-01-31 9:02 UTC (permalink / raw)
To: linux-audit
[-- Attachment #1: Type: text/plain, Size: 228 bytes --]
Hello,
auparse would crash if there was an interpreted filter item defined and
the field could not be interpreted (e.g. it had an invalid format).
The attached patch modifies auparse to use the raw value in such cases.
Mirek
[-- Attachment #2: audit-1.6.6-auparse-crash.patch --]
[-- Type: text/x-patch, Size: 518 bytes --]
diff -ur audit/auparse/auparse.c audit-1.6.6/auparse/auparse.c
--- audit/auparse/auparse.c 2007-11-19 19:44:04.000000000 +0100
+++ audit-1.6.6/auparse/auparse.c 2008-01-31 09:41:02.000000000 +0100
@@ -899,9 +899,10 @@
if (search_op == AUSEARCH_EXISTS)
return 1;
+ val = NULL;
if ((rule->search_op & AUSEARCH_INTERPRETED) != 0)
val = nvlist_interp_cur_val(r);
- else
+ if (val == NULL)
val = nvlist_get_cur_val(&r->nv);
rc = strcmp(rule->v.field.val, val);
if (search_op == AUSEARCH_EQUAL)
[-- Attachment #3: Type: text/plain, Size: 0 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] Fix error handing when searching for an interpreted value
2008-01-31 9:02 [PATCH] Fix error handing when searching for an interpreted value Miloslav Trmac
@ 2008-01-31 15:03 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2008-01-31 15:03 UTC (permalink / raw)
To: linux-audit
On Thursday 31 January 2008 04:02:06 Miloslav Trmac wrote:
> auparse would crash if there was an interpreted filter item defined and
> the field could not be interpreted (e.g. it had an invalid format).
Applied, thanks!
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-01-31 15:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-01-31 9:02 [PATCH] Fix error handing when searching for an interpreted value Miloslav Trmac
2008-01-31 15:03 ` Steve Grubb
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox