syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)

[platform/upstream/glibc.git] / misc / syslog.c

diff --git a/misc/syslog.c b/misc/syslog.c
index 53440e4..4af87f5 100644 (file)
--- a/misc/syslog.c
+++ b/misc/syslog.c
@@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c  8.4 (Berkeley) 3/18/94";
 #include <sys/uio.h>
 #include <sys/un.h>
 #include <syslog.h>
+#include <limits.h>
 
 static int LogType = SOCK_DGRAM;       /* type of socket connection */
 static int LogFile = -1;               /* fd for log */
@@ -219,7 +220,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
     vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags);
     va_end (apc);
 
-    if (vl < 0)
+    if (vl < 0 || vl >= INT_MAX - l)
       goto out;
 
     if (vl >= len)