From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Tue, 28 Jun 2022 19:52:54 +0000 (+0900)
Subject: sd-journal: data object may be invalid after data_object_in_hash_table()
X-Git-Tag: v252-rc1~755^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F23836%2Fhead;p=thirdparty%2Fsystemd.git

sd-journal: data object may be invalid after data_object_in_hash_table()

Fixes a bug introduced by 578cd1855b73d2710ae14a8d77c4fac1d8ea7f48.

The function `data_object_in_hash_table()` calls
`journal_file_move_to_object()` with `OBJECT_DATA`. Hence,
previously obtained pointer to a data object may be now invalid.

Fixes #23794.
---

diff --git a/src/libsystemd/sd-journal/journal-verify.c b/src/libsystemd/sd-journal/journal-verify.c
index 14954503949..03c79cea136 100644
--- a/src/libsystemd/sd-journal/journal-verify.c
+++ b/src/libsystemd/sd-journal/journal-verify.c
@@ -670,6 +670,11 @@ static int verify_entry(
                         return -EBADMSG;
                 }
 
+                /* Pointer might have moved, reposition */
+                r = journal_file_move_to_object(f, OBJECT_DATA, q, &u);
+                if (r < 0)
+                        return r;
+
                 r = journal_file_move_to_entry_by_offset_for_data(f, u, p, DIRECTION_DOWN, NULL, NULL);
                 if (r < 0)
                         return r;