From 52bcf45a6c2b25e58b0a798b0cdc3c4d0d5cc961 Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Wed, 12 Oct 2022 15:45:55 +0900
Subject: [PATCH] sd-journal: use new() instead of newa() if too many items
 will be added

For safety, as the size may not be under our control.
---
 src/libsystemd/sd-journal/journal-file.c | 27 ++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/src/libsystemd/sd-journal/journal-file.c b/src/libsystemd/sd-journal/journal-file.c
index 02e9b9a6742..c1ec6bb1d85 100644
--- a/src/libsystemd/sd-journal/journal-file.c
+++ b/src/libsystemd/sd-journal/journal-file.c
@@ -2232,10 +2232,11 @@ int journal_file_append_entry(
                 Object **ret_object,
                 uint64_t *ret_offset) {
 
+        _cleanup_free_ EntryItem *items_alloc = NULL;
         EntryItem *items;
-        int r;
         uint64_t xor_hash = 0;
         struct dual_timestamp _ts;
+        int r;
 
         assert(f);
         assert(f->header);
@@ -2262,7 +2263,15 @@ int journal_file_append_entry(
                 return r;
 #endif
 
-        items = newa(EntryItem, n_iovec);
+        if (n_iovec < ALLOCA_MAX / sizeof(EntryItem) / 2)
+                items = newa(EntryItem, n_iovec);
+        else {
+                items_alloc = new(EntryItem, n_iovec);
+                if (!items_alloc)
+                        return -ENOMEM;
+
+                items = items_alloc;
+        }
 
         for (size_t i = 0; i < n_iovec; i++) {
                 uint64_t p;
@@ -3975,10 +3984,11 @@ int journal_file_dispose(int dir_fd, const char *fname) {
 }
 
 int journal_file_copy_entry(JournalFile *from, JournalFile *to, Object *o, uint64_t p) {
+        _cleanup_free_ EntryItem *items_alloc = NULL;
+        EntryItem *items;
         uint64_t q, n, xor_hash = 0;
         const sd_id128_t *boot_id;
         dual_timestamp ts;
-        EntryItem *items;
         int r;
 
         assert(from);
@@ -3996,7 +4006,16 @@ int journal_file_copy_entry(JournalFile *from, JournalFile *to, Object *o, uint6
         boot_id = &o->entry.boot_id;
 
         n = journal_file_entry_n_items(from, o);
-        items = newa(EntryItem, n);
+
+        if (n < ALLOCA_MAX / sizeof(EntryItem) / 2)
+                items = newa(EntryItem, n);
+        else {
+                items_alloc = new(EntryItem, n);
+                if (!items_alloc)
+                        return -ENOMEM;
+
+                items = items_alloc;
+        }
 
         for (uint64_t i = 0; i < n; i++) {
                 uint64_t h;
-- 
2.47.3